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1 .  INTRODUCTION 


The  availability  of  a  maturing  electronics  technology  in  flight 
controls  has  established  the  possibility  of  significant  payoffs 
in  the  utilization  of  fly-by-wire  concepts  for  helicopter 
flight  control  systems  (FCS).  Whether  such  payoffs  are  to  be 
available  in  an  Advanced  Scout  Helicopter  (ASH)  size  helicopter 
is  the  question  to  which  this  effort  has  been  directed. 

Specifically,  this  effort  has  established  a  preliminary  design 
fly-by-wire/light  (FBW/L)  control  system  in  sufficient  detail 
that  a  quantitative  comparison  to  a  dual  mechanical  control 
system  could  be  made. 

The  system  resulting  from  the  preliminary  design  utilizes 
optical  transducers  to  measure  pilot  input  and  optical  fibers 
to  transfer  command  inputs  to  power  actuators  controlling  the 
helicopter.  This  system  is  referred  to  as  a  fly-by-wire/light 
control  system  due  to  the  fact  that  "wires"  and  "light"  are 
used  to  implement  helicopter  control  instead  of  the  conven¬ 
tional  push-pull  tube  mechanisms. 

The  preliminary  design  FBW/L  system  utilizes  a  multiarm  rise/ 
fall  swashplate,  independent  channel  concept  for  the  main 
rotor  and  a  redundant  path  electromechanical  implementation 
for  both  the  horizontal  stabilizer  (elevator)  and  tail  rotor. 
This  system  was  compared  to  a  dual  mechanical  control  system 
for  a  particular  baseline  helicopter  in  the  following  areas: 

-  Flight  safety  reliability 

-  Mission  reliability 

-  Vulnerability 

-  System  reliability,  availability,  and  maintainability 

-  Control  system  weight 

-  Electrical  and  hydraulic  power  supply  requirements 

-  Initial  and  life-cycle  cost 

-  Predicted  handling  qualities 

In  addition  to  the  quantitative  comparison,  the  effort  in¬ 
vestigated  the  possibility  of  gaining  additional  payoffs  from 
the  use  of  innovative  thinking  relative  to  cockpit  controls 
and  mission  displays.  The  FBW/L  control  may  be  viewed  as  part 


of  the  total  modernization  of  the  helicopter's  cockpit  and 
instruments  that  is  required  to  perform  the  demanding  crew 
tasks  associated  with  the  flight  controls  and  mission  equip¬ 
ment  of  the  ASH.  The  nap-of-the-earth  flight  tasks,  with 
periodic  unmasking  for  target  detection  and  attack,  requires 
automatic  and  crew-commanded  functions.  Through  command 
augmentation,  the  helicopter  can  be  made  to  exhibit  decoupled 
controls,  automatic  turn  coordination,  trim  compensation  for 
power  change  effects,  and  compensation  for  downwash  effects  on 
the  horizontal  stabilizer.  These  features  allow  the  pilot  to 
concentrate  his  effort  more  on  the  tactical  situation  and  less 
on  the  basic  flight  requirements.  Special  displays  and  con¬ 
trols,  such  as  side-arm  and  push-button  controls,  may  be 
implemented  for  use  with  the  FBW/L  and  automatic  flight  control 
system  that  offers  savings  in  weight  and  cockpit  space. 

Section  2  presents  the  details  of  the  preliminary  design  of 
the  FBW/L  control  system.  Special  attention  was  given  to  the 
determination  of  the  size,  space,  and  configuration  constraints 
imposed  by  the  baseline  helicopter  as  described  in  the  Refer¬ 
ence  1  report.  Both  the  dual  mechanical  and  the  FBW/L  control 
systems  were  addressed  in  the  predesign  effort  to  a  sufficient 
technical  depth  to  insure  a  realistic  quantitative  comparison. 

Section  3  presents  the  specific  details  of  the  quantitative 
comparison  in  the  various  areas.  It  is  shown  that  significant 
benefits  are  predicted  in  all  areas  of  comparison. 

Section  4  presents  a  discussion  of  the  particular  redundancy 
management  techniques  proposed  for  the  FBW/L  control  system. 
Five  different  states  of  each  of  the  rotor  control  actuators 
were  identified  and  quantified  by  a  failure  model.  These 
states  were  then  considered  in  various  combinations  to  derive 
mission  abort  and  flight  safety  critical  situations.  The 
probability  of  these  events  was  derived  using  statistical  tech¬ 
niques  and  these  techniques  were  utilized  in  the  reliability 
predictions  of  the  quantitative  comparison. 

Section  5  presents  a  discussion  of  the  potential  for  advanced 
cockpit  controls  and  displays  in  a  FBW/L  implementation. 


xHoffstadt,  Donald  J.,  and  Swatton,  Sidney,  ADVANCED  HELICOP¬ 
TER  STRUCTURAL  DESIGN  INVESTIGATION,  VOLUME  I  -  INVESTIGATION 
OF  ADVANCED  STRUCTURAL  COMPONENT  DESIGN  CONCEPTS,  Boeing 
Vertol  Co.,  USAAMRDL  TR  75-56A,  Eustis  Directorate,  U.S.  Army 
Air  Mobility  Research  and  Development  Laboratory,  Fort  Eustis, 
Virginia,  March  1976,  ADA024662. 
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Advantages  and  disadvantages  of  between- the- legs  versus  side- 
arm  sticks,  and  displacement-control  versus  force-control 
sticks  are  presented. 

Section  6  presents  an  evaluation  of  the  significance  of  a 
lighter  control  system  as  provided  by  the  FBW/L  control  system. 
Basically,  the  weight  savings  may  be  utilized  for  extra  fuel 
(more  range)  or  extra  payload. 
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2.  PRELIMINARY  DESIGN 


In  the  following  paragraphs,  the  definition  of  both  a  dual  me¬ 
chanical  control  system  and  a  fly-by-wire  control  system  will 
be  presented.  These  two  systems  are  defined  to  satisfy  the 
requirements  of  the  ASH  mission  and  will  be  quantitatively 
compared  in  subsequent  sections  of  this  report. 

2.1  DUAL  MECHANICAL  DEFINITION 

In  order  to  assess  the  desirability  of  a  FBW  FCS  in  the  ASH,  a 
baseline  helicopter  dual  mechanical  flight  control  system  con  ■ 
figured  for  the  ASH  mission  was  defined  as  discussed  in  the 
following  paragraphs. 

2 . .  1  Baseline  Definition 

The  baseline  aircraft  was  designed  during  an  advanced  struc¬ 
tures  study  of  a  medium-range  utility  transport  (MUT)  helicop¬ 
ter.  This  vehicle  is  shown  in  Figure  1  from  USAAKRDL  Report 
TR  75-56A  (Reference  1).  The  MUT  has  a  gross  weight  of  9544 
pounds  and  a  payload  of  960  pounds. 

This  design  features  a  single,  main  rotor  system  employing  a 
hingeless  rotor  blade  concept  that  is  powered  by  twin  advanced 
technology  engines . 

The  pilot's  compartment  accommodates  a  crew  of  two  with  side- 
by-side  seating;  the  aircraft's  critical  dimensions  are  noted 
on  the  drawing  in  Figure  2 . 

Flight  control  of  the  aircraft  is  accomplished  by  using  a 
redundant  mechanical  system  coupled  with  inputs  from  a  redun¬ 
dant  SCAS  (Stability  Control  Augmentation  System)  to  hydraulic 
actuators  controlling  the  main  and  tail  rotors  (Figure  3). 

The  main  rotor  actuators  impart  motion  to  the  nonrotating  ring 
of  the  swashplate  assembly.  This  motion  is  transferred  to  the 
rotating  ring  of  the  swashplate  that  provides  pitch  control  to 
the  rotor  blades  through  pitch  links. 

The  tail  rotor  actuators  impart  motion  to  the  rotating  sliding 
sleeve  on  the  tail  rotor  shaft.  The  sleeve  transfers  pitch 
control  to  the  tail  rotor  blades  through  pitch  links. 

The  drive  system  consists  of:  two-engine  right-angle-nose, 
main  rotor,  intermediate,  and  tail  rotor  transmissions;  acces¬ 
sory  gearboxes;  and  interconnecting  sectionalized  shafting 
( Figure  4 ) . 
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Figure  1.  Medium-range  utility  transport  helicopter  (MUT) . 
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Figure  4.  Drive  system. 


The  primary  electrical  power  supply  is  provided  by  ac  genera¬ 
tors,  one  on  each  accessory  gearbox  ( AGB ) .  One  generator  is 
capable  of  supplying  the  entire  aircraft  electrical  power  if 
necessary.  The  generators  also  provide  for  dc  power  by  con¬ 
verting  through  transformer/rectifiers. 

A  28-volt  battery  (located  in  the  nose  avionics  compartment) 
is  used  for  engine  starting  and  is  interlocked  into  the  elec¬ 
trical  system  for  emergency  use. 

The  flight  control  hydraulic  system  consists  of  two  indepen¬ 
dent  systems,  with  a  utility  system  as  an  emergency  backup. 
Each  system  is  completely  separated  from  the  other  and  con¬ 
sists  of  a  pump  cooler  unit,  hydraulic  component  module, 
accumulator,  and  associated  hydraulic  lines. 

A  utility  hydraulic  system  operates  at  3000  psi.  It  supplies 
power  for  kneeling/unkneeling  of  the  main  landing  gear  and 
serves  as  an  emergency  source  of  hydraulic  pressure  for  the 
flight  control  system.  The  system  consists  of  items  such  as 
an  accumulator,  an  ac  electric-driven  hydraulic  pump,  a  two- 
stage  handpump,  plus  filter,  and  relief  valves. 

The  horizontal  stabilizer  is  controlled  electrically  by  means 
of  a  two-motor  electromechanical  actuator.  Linkage  between 
the  stabilizer  and  fuselage  structure  is  designed  to  prevent 
free  floating  of  the  stabilizer  during  mechanical,  electrical, 
or  ballistic  damage  failure.  The  control  system  is  common  to 
both  the  dual  mechanical  and  the  fly-by-wire  implementations. 

2.1.2  Mission  Requirements  Impact 

Mission  requirements  dictate  that  the  baseline  MUT  control 
system  be  augmented  to  include  altitude,  airspeed,  and  hover- 
hold  functions.  Control  response  sensitivity,  effectiveness, 
and  damping  are  to  be  optimized  to  allow  terrain  following  and 
NOE  flight,  as  well  as  cruise  flight.  Equipment  sufficient  to 
accomplish  these  functions  include  4-axis  autopilot  servos, 
skewed  sensor-inertial  navigation  system  assemblies,  autopilot 
controller  assemblies,  air  data  sensor  assemblies,  and  multi¬ 
plex  remote  terminal  unit  assemblies .  These  equipments  will 
be  common  to  both  the  dual  mechanical  mechanization  and  the 
fly-by-wire  mechanization. 

2.1.3  Overview  of  the  Dual  Mechanical  System 

Flight  control  system  components  unigue  to  the  dual  mechanical 
mechanization  includes  the  tail  rotor,  main  rotor  pitch,  main 
rotor  roll,  and  main  rotor  collective  series  servos.  These 
series  servos  provide  automatic  flight  control  functions  in 
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series  with  the  pilot’s  control  inputs.  In  addition,  the  dual 
mechanical  system  includes  dual  boost  servos,  dual  electric 
power  generators,  dual  control  system  hydraulic  pumps,  control 
system  linkages  and  mixers,  and  a  utility  backup  hydraulic 
system.  Table  1  lists  the  type  and  redundancy  characteristics 
of  the  mechanical  baseline  system.  A  block  diagram  of  the 
system  is  shown  in  Figure  5.  The  controls  layout  for  the  dual 
mechanical  system  is  shown  in  Figure  6. 


TABLE  1. 

DUAL  MECHANICAL 
CHARACTERISTIC 

SYSTEM 

REDUNDANCY 

Function 

Type 

Redundancy 

Cyclic  and  collec¬ 
tive  boost  actuators 

Hydraulic 

Dual, 

fail-operate 

Tail  rotor  boost 
actuator 

Hydraulic 

Dual, 

fail-operate 

Cyclic  and  collec¬ 
tive  actuators 

Electro¬ 

mechanical 

Dual, 

fail-safe 

Tail  rotor  series 
actuator 

Electro¬ 

mechanical 

Dual, 

fail-safe 

Elevator  servo 

Electro¬ 

mechanical 

Dual , 

fail-safe 

Autopilot/trim 
parallel  servos 

Electro¬ 

mechanical 

Nonredundant,  fail¬ 
safe 

2.2  FLY-BY-WIRE  DEFINITION 

The  fly-by-wire  system  consists  of  equipment  that  controls  the 
helicopter  main  rotor,  horizontal  stabilizer,  and  tail  rotor. 
The  main  rotor  is  controlled  by  the  STAR  system  that  utilizes  a 
multiarm  swashplate  that  is  positioned  by  electrically  con¬ 
trolled  hydraulic _ actuators,  as  shown  in  Figures  7  and  8.  The 
horizontal  stabilizer  is  controlled  by  means  of  an  electro¬ 
mechanical  actuator  and  is  common  to  both  the  dual  mechanical 
system  and  the  fly-by-wire  system  implementation.  The  tail 
rotor  is  controlled  by  three  electric  servomotors  that  move 
the  tail  rotor  crosshead.  These  systems  and  special  features 
will  be  described  in  the  following  sections. 
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Figure  6.  Layout  of  dual  mechanical  control  system. 
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Figure  7.  STAR  mechanization. 
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Figure  8.  STAR  control  (typical  channel) 


2.2.1  Main  Rotor  Control  Configuration 

Main  rotor  loads  are  generated  by  the  main  rotor  system  as  de¬ 
scribed  below: 

Four-blade  rotor  with  rotor  diameter  of  38.9  feet 


Solidity 
Blade  chord 
Rotor  tip  speed 
Helicopter  velocity 
Rotor  speed 


0.1 

18.33  inches 
750  fps 
150  kt 
368  rpm 


Control  of  the  rotor  system  must  be  insured  during  both  level 
and  maneuvering  flight.  In  the  predesign  effort,  four-,  five-, 
and  six-actuator  configurations  were  considered  for  control 
of  the  main  rotor  swashplate. 


Consideration  was  given  to  space,  weight,  and  reliability  im¬ 
pact  of  the  three  configurations.  Each  configuration  was 
considered  as  utilizing  single-piston,  integrated  actuator 
packages  (IAPs)  with  single  or  multiple  electrohydraulic 
servovalves  (EHSVs)  for  control  input. 

The  four-actuator  approach  lacked  attractiveness  because  of 
the  fundamental  one-fail-operate  nature  of  the  geometrical 
configuration.  To  insure  control  after  a  second  system  fail¬ 
ure,  each  actuator  must  be  designed  (as  a  minimum)  to  be 
operational  after  a  first  failure  and  bypassed  after  a  second 
failure. 


This  necessitates  at  least  two  EHSVs  on  each  1AP,  triplex  signal 
paths,  with  one  path  driving  an  electronic  model  and  fail-operate 
hydraulic  power  for  each  of  the  four  control  channels  to  the  main 
rotor  swashplate  arms.  Such  a  configuration  became  overly  complex 
during  the  predesign  effort  and  was  discarded. 

The  six-actuator  approach  presented  initial  attract.iveness  be¬ 
cause  of  its  apparent  geometrical  superiority  after  first  and 
second  failure  situations.  Each  channel  could  be  designed  to 
operate  as  fail/bypass,  which  would  switch  the.  actuator  into  by¬ 
pass  after  any  channel  failure. 

Sizing  the  actuators  so  that  four  actuators  would  react  swash¬ 
plate  loads  after  two  failures  resulted  in  smaller  actuators 
than  required  using  the  five-actuator  approach. 

However,  as  the  predesign  effort  progressed,  it  became 
apparent  that  the  added  hardware  to  implement  the  additional 
independent  hydraulic  and  electrical  supplies  and  the  pilot 
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control  motion  sensors  resulted  in  added  weight  and  signi¬ 
ficant  space  problems  around  tne  helicopter  transmission.  In 
fact,  the  requirements  for  dual  engine,  tail  rotor,  and 
accessory  gearbox  drives  prevented  the  six-actuator  imple¬ 
mentation  from  being  a  practical  alternative. 

The  main  rotor  control  system  selected  for  quantitative  com¬ 
parison  with  the  dual  mechanical  system  is  the  five-actuator 
STAR  mechanization.  The  transmission  configuration  layout  is 
shown  in  Figure  9.  To  accommodate  the  installation,  the  MUT 
transmission  input  driveshafts  are  canted  aft  7.2  degrees,  and 
the  forward  accessory  gearbox  is  angled  25  degrees  to  the 
right.  Each  of  the  five  control  channels  has  electrical  and 
hydraulic  power  supplies,  pilot  control  motion  sensors,  and 
actuator  control  and  monitoring  electronics.  Each  channel  is 
self-sufficient  and  isolated  from  the  other  four  channels, 
except  for  failure  condition  information  that  is  shared  via 
fiber  optic  signal  links. 

Redundant  fiber  optic  cables  are  used  to  transmit  control 
input  information  from  the  cockpit  to  the  5  IAPs,  in.  addition 
to  monitoring  and  displaying  the  status  of  one  IAP  relative  to 
another.  Optical  encoders  located  at  a  control  mixer  in  the 
cockpit  transmit  light  signals  from  both  pilot  and  autopilot 
control  inputs  to  the  IAPs. 

Redundant  computers  are  powered  from  the  two  main  electrical 
buses  in  the  aircraft  and  provide  secondary  control  inputs 
such  as  SCAS  and  hover  augmentation.  A  loss  of  one  computer 
is  not  mission  critical,  nor  is  the  loss  of  both  computers 
critical  to  safety  of  flight. 

Two  300  cfm  blowers  are  mounted,  one  each,  on  the  forward  and 
aft  accessory  gearboxes  for  the  purpose  of  cooling  the  IAPs 
during  the  hover  mission.  One  operating  blower  is  adequate, 
two  are  provided  for  redundancy,  and  they  use  the  gearbox 
drives  vacated  by  the  dual-mechanical  hydraulic  pumps. 

Conventional  control  sticks  are  depicted  for  this  baseline 
fly-by-wire  definition;  however,  new,  smaller,  and  possibly 
combined  function  controllers  appear  very  attractive  for  the 
FBW  control  system.  These  will  be  discussed  in  Section  5. 

Ground  check  of  the  flight  controls  is  accomplished  with  the 
rotor  stopped.  A  400-cycle  ac  power  cart  is  used  to  operate 
the  onboard  motorpump  to  provide  the  necessary  hydraulic  power 
for  ground  checkout,  without  the  requirement  to  power  the 
rotor  system. 
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2.2.2  Tail  Rotor  Control  Configuration 


The  tail  rotor  control  configuration  is  an  electromechanical 
configuration  using  three  electrically  powered  and  controlled 
motors.  These  motors  drive  through  a  simple  mechanical  torque 
breakout  device  into  a  single  gear  that  is  attached  to  a  quill 
that  controls  the  sliding  sleeve  on  the  tail  rotor  shaft.  The 
system  is  similar  to  the  installation  flight  tested  under 
contract  DAAJ01-77-C-0070  (References  2  and  3). 

The  torque  breakout  devices  are  designed  such  that  the  torque 
limit  is  150  ±  10  percent  of  the  stall  torque  of  the  motor  and 
is  intended  to  eliminate  any  requirement  for  acceleration 
control  of  the  motors.  Three  output  gears  of  the  three  motors 
drive  a  common  gear  of  the  control  quill.  An  Acme  screw 
portion  of  the  quill,  which  converts  rotary  motion  to  linear 
motion,  projects  into  the  tail  rotor  gearbox.  Attached  to  the 
Acme  screw  is  a  control  tube  that  passes  through  the  tail 
rotor  mast  to  connect,  via  bearings,  to  the  rotating  controls 
of  the  tail  rotor.  A  layout  depicting  the  configuration  of 
the  tail  rotor  transmission  and  control  quill  is  shown  in 
Figure  10. 

Three  passive  sensors  are  also  attached  to  pedals  in  the 
cockpit  to  provide  control  input  to  three  separate  electronic 
channels  that  control  each  of  the  three  electric  motors.  In 
addition,  commands  from  redundant  computers  provide  command 
augmentation,  which  is  additive  to  the  pilot's  inputs.  Each 
channel  is  a  simple  position  servosystem  consisting  of  an 
error  amplifier  and  comparison  means  between  actual  and  com¬ 
mand  positions.  The  amplifier  is  a  modular  type  having  ade¬ 
quate  amplification  and  power  to  drive  the  servomotors  directly 
from  the  error  signal.  The  total  error  signal  consists  of  the 
vector  sum  of  pedal  position,  actuator  position,  command 
augmentation,  and  motor  velocity  signals. 

The  fault-monitoring  circuit  is  designed  to  compare  the  abso¬ 
lute  value  of  each  tach  generator  signal  with  the  average  of 
the  three.  The  resultant  dc  signals  represent  tach  motor 


2 Stephens,  W. ,  and  Hampton,  B.,  FLY-BY-WIRE  TAIL  ROTOR  CON¬ 
TROLS,  presented  at  the  American  Helicopter  Society  Special¬ 
ists  Meeting  on  Helicopter  Flight  Controls,  Arlington, 

Texas,  October  1978. 

3Blount,  P.,  RESULTS  OF  A  GROUND  AND  FLIGHT  TEST  OF  A  MODEL 
AH-1G  EQUIPPED  WITH  A  209-961-468-1  FLY-BY-WIRE  DIRECTIONAL 
CONTROL  INSTALLATION,  Bell  Helicopter  Textron  Report  No. 
299-099-930,  June  1979. 
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velocity,  regardless  of  direction  of  rotation  of  the  indivi¬ 
dual  motors.  Filtering  provides  immunity  to  noise  by  slowing 
the  response  to  an  acceptable  level.  The  resultant  signals 
are  summed  and  divided  by  a  resistor  network  to  form  an  aver¬ 
age  signal  equal  to  each  other.  Signal  comparators,  contained 
in  one  integrated  circuit,  compare  each  signal  with  the  aver¬ 
age.  The  three  comparator  outputs  are  then  decoded  by  a 
combination  of  one  integrated  circuit  and  transistor  logic  to 
provide  failure  information.  An  "exclusive  or"  logic  of  an 
integrated  circuit  is  combined  with  an  "and"  logic  of  the 
transistor  circuits  to  provide  a  warning  when  any  tach  gener¬ 
ator  signal  disagrees  in  absolute  value  with  the  other  two. 

The  circuit  sensitivity  is  set  to  provide  a  warning  when 
approximately  30  percent  speed  difference  exists. 

2.2.3  Command  Augmentation  System  Interface 

In  order  to  perform  mission-oriented  flight  functions,  it  is 
necessary  that  the  pilot's  primary  control  be  augmented  by  a 
control  augmentation  system.  This  system  is  functionally 
integrated  with  a  dual  multiplex  bus  system  that  transmits 
augmentation  signals  to  the  main  rotor,  tail  rotor,  and  hori¬ 
zontal  stabilizer,  as  depicted  in  Figure  11. 

The  dual  configuration  of  the  IAP  electronics  allows  for 
straightforward  interface  to  the  dual  SCAS  system.  Fiber 
optic  links  are  used  in  the  IAP/SCAS  interface  to  manage  EMI 
problems.  All  data  are  transmitted  in  digital  pulse  form  with 
the  necessary  encoding  and  decoding  provided  in  each  control 
sensor  and  IAP  electronic  module  unit. 

Stick  position  data  required  by  the  SCAS  is  obtained  indi¬ 
rectly  through  the  IAP,  rather  than  directly  from  the  stick 
sensors.  This  design  choice  is  driven  by  power  and  light  loss 
considerations  in  the  passive  stick  sensors  and  by  the  reduc¬ 
tion  in  fiber  optic  connectors  and  receivers  that  is  obtained 
when  compared  to  the  direct  connection  configuration.  In 
addition  to  the  stick  position  data,  IAP  status  data  are  also 
transmitted  to  the  SCAS  computers.  The  SCAS  computers  perform 
the  IAP  interconnect  logic  function. 

SCAS  commands,  based  on  aircraft  motions  and  stick  positions 
are  generated  in  each  computer  and  returned  to  the  IAP  through 
the  fiber  optic  link.  The  SCAS  computer  status  and  the  actua¬ 
tor  control  outputs  from  the  interconnect  logic  computations 
are  also  transmitted  to  the  IAP. 
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2.2.4  Overview  of  the  Fly-By-Wire  System 

Flight  control  system  components  unique  to  the  fly-by-wire/ 
light  mechanization  include  the  triplex  electromechanical  tail 
rotor  control  and  the  STAR  main  rotor  control  that  features 
passive  sensors,  optical  cockpit  sensors,  hydraulic-mounted 
electronics,  and  dedicated  hydraulic  and  electrical  power 
supplies.  Table  2  lists  the  type  and  redundancy  characteris¬ 
tics  of  the  fly-by-’Wire/light  mechanization. 


TABLE  2.  FLY-BY-WIRE  SYSTEM  REDUNDANCY  CHARACTERISTICS 


Function _ Type _ Redundancy 


Cyclic  &  col¬ 
lective 

Electrohydraulic 

Five  channel  9 
(Fail-Operate)z 

Tail  rotor 

Electromechanical 

Triplex 

Fail-Operate 

Elevator 

servo 

Electromechanical 

Dual 

Fail-Safe 

Autopilot/trim 
Parallel  servos 

Electromechanical 

Nonredundant 

Fail-Safe 

Table  3  lists  the  size,  weight,  and  reliability  characteris¬ 
tics  of  various  electronic  subassemblies.  A  block  diagram  of 
the  system  is  shown  in  Figure  12 .  The  controls  layout  is 
depicted  in  Figure  13. 

2.2.5  Hydraulic  System  Features 

The  main  rotor  control  system  fly-by-wire/light  implementation 
utilizes  five  integrated  actuator  packages,  five  dedicated 
hydraulic  pumps,  and  one  auxiliary  hydraulic  pump  that  pro¬ 
vides  f.ill-and-bleed  capability  and  ground  check  capability 
without  the  requirement  for  the  engine  to  be  running. 

2. 2. 5.1  Actuator  Load  Requirements .  The  design  requirements 
for  the  main  rotor  power  actuators  depend  upon  the  size  of  the 
vehicle,  the  type  of  rotor  system  employed,  and  the  particular 
criteria  selected  for  post-system-failure  operation.  For 
purposes  of  this  preliminary  design,  the  criteria  listed  in 
Table  4  are  considered. 
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TABLE  3.  DESCRIPTION  OF  FLY-BY-WIRE  SUBASSEMBLIES 
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Figure  12.  Block  diagram  of  ASH  mission  FBW/L  control  system. 


TABLE  4.  OPERATIONAL  CRITERIA  FOR  STAR  MAIN 
ROTOR  CONTROL 

Case  Condition  Criteria 


I 

All  IAPs  Normal 

Maneuver 

Loads, 

VH 

II 

One  IAP  bypassed 

Maneuver 

Loads, 

VH 

III 

Two  IAPs  bypassed 

Cruise, 

IV 

One  IAP  failed  and  force 
fighting  (multiple  failure 
of  electronic  monitors) 

Maneuver 

Loads, 

0.6  VR 

V 

Two  IAPs  bypassed 

Maneuver 

Loads , 

0.6  VH 

Exact  properties  of  the  four-bladed  rotor  system  for  the  MUT 
vehicle  were  not  available.  Thus,  the  specific  harmonic 
allocation  of  the  swashplate  loads  were  not  known.  Since  the 
magnitude  of  oscillatory  loads  are  much  larger  for  a  two- 
bladed  rotor  system,  it  appeared  conservative  to  reference  BHT 
two-bladed  data  when  establishing  the  maximum  load  require¬ 
ments  for  the  MUT  IAPs .  Under  the  condition  that  two  side-by- 
side  lAPs  are  disabled  and  bypassed,  the  remaining  IAPs  are 
required  to  react  steady  loads  of  2620  pounds  and  oscillatory 
loads  of  ±1610  pounds.  The  IAP  designed  to  this  load  require¬ 
ment  is  depicted  in  Figure  14. 

The  force  of  4230  pounds  was  established  for  the  MUT  IAPs 
using  similar  analyses  as  were  used  to  design  the  AH-1  Cobra 
IAPs.  In  the  following  paragraphs,  a  discussion  of  results 
from  previous  Model  AH-1  predesign  activities  is  presented  for 
use  as  substantiating  design  data. 

IAP  reactions  were  calculated  from  fixed  system  swashplate 
shears  and  moments.  Final  histories  of  these  shears  and 
moments  were  generated  from  measured  pitch  link  loads  combined 
(after  resolution  into  the  fixed  system)  with  actuator  forces 
resulting  from  the  conditions  of  Table  4.  Tables  5  through  9 
present  a  tabulation  of  the  calculated  actuator  reactions 
shown  as  R1-R5  as  a  function  of  reference  blade  azimuth.  The 
IAP  design  load  was  determined  to  be  5100  pounds. 

2. 2. 5. 2  Integrated  Actuator  Package.  To  maintain  isolation 
between  the  various  hydraulic  systems,  the  concept  of  multiple 
integrated  actuator  packages  and  dedicated  pumps  is  used. 

This  concept  provides  true  control  redundancy  from  the  pilot's 
control  input  to  the  output  of  the  power  actuator. 
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TABLE  5.  MANEUVER  LOADS  @  V„ 

H 


FIVE 

ACTUATORS 

OPERATING 

AZIMUTH 

IAP 

OMEGAT 

R1 

R2 

R3 

R4 

R5 

0.00 

1517 

1725 

1646 

1388 

1308 

5.62 

1472 

1966 

1843 

1273 

1044 

11.25 

1336 

2207 

2094 

1154 

686 

16.87 

1104 

2420 

2392 

1060 

263 

22.50 

777 

2576 

2721 

1011 

-190 

28.12 

361 

2648 

3053 

1017 

-647 

33.75 

-129 

2616 

3361 

1077 

-1080 

39.37 

-666 

2469 

3612 

1186 

-1458 

45.00 

-1206 

2209 

377.9 

1334 

-1747 

50.62 

-1695 

1856 

0830 

1507 

-1911 

56.25 

-2072 

1444 

376  4 

1682 

-1925 

61.87 

-2287 

1017 

3561 

1830 

-1784 

67.50 

-2316 

621 

3240 

1922 

-1512 

73.12 

-2168 

296 

2831 

1934 

-1156 

78.75 

-1885 

64 

2379 

1861 

-774 

84.37 

-1528 

-74 

1932 

1717 

-421 

90.00 

-1156 

-129 

1532 

1532 

-129 

95.62 

-816 

-126 

1207 

1340 

91 

101.25 

-527 

-84 

965 

1171 

249 

106.87 

-287 

-19 

799 

10  36 

365 

112.50 

-82 

65 

694 

935 

456 

118.12 

104 

169 

6  36 

860 

531 

123.75 

281 

294 

618 

805 

596 

129.37 

447 

435 

6  36 

774 

657 

135.00 

601 

581 

693 

781 

724 

140.62 

740 

722 

783 

839 

813 

146.25 

870 

848 

899 

952 

935 

151.87 

999 

959 

3025 

1105 

10  89 

157.80 

1132 

1065 

1149 

1267 

1257 

163.12 

1268 

1182 

12  63 

1399 

1401 

168.75 

1392 

1327 

1374 

1468 

1479 

174.37 

1483 

1508 

1495 

1461 

1454 

180.00 

1517 

1725 

1646 

1388 

1308 
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TABLE  6.  MANEUVER  LOADS  @  V„ 

ri 

_ FOUR  ACTUATORS  OPERATING/ONE  BYPASSED 


AZIMUTH  IAP 


OMEGAT 

R1 

R2 

R3 

R4 

0.00 

2430 

1089 

1298 

2769 

5.62 

2074 

1080 

1573 

2874 

11.25 

1618 

981 

1851 

3029 

16.87 

1119 

778 

2093 

3252 

22.50 

625 

466 

2263 

3542 

28.12 

172 

49 

2333 

3881 

33.75 

-213 

-460 

2282 

4237 

39.37 

-505 

-1029 

2101 

4577 

45.00 

-675 

-1616 

1796 

4864 

50.62 

56.25 

-699 

-571 

-2158 

-2589 

1390 

923 

5060 

<'513CL> 

61.87 

-309 

-2850 

450 

5047 

67.50 

37 

-2907 

27 

4800 

73.12 

404 

-2764 

-302 

4400 

78.75 

727 

-2459 

-512 

3888 

84.37 

965 

-2057 

-604 

3323 

90.00 

1107 

-1628 

-603 

2772 

95.62 

1173 

-1229 

-540 

2292 

101.25 

1195 

-888 

-446 

1912 

106.87 

1203 

-607 

-339 

1637 

112.50 

1212 

-370 

-223 

1451 

118.12 

1227 

-161 

-9  6 

1332 

123.75 

1247 

33 

46 

1269 

129.37 

1283 

209 

196 

1262 

135.00 

1356 

360 

341 

1324 

140.62 

1492 

482 

464 

1462 

146.25 

1705 

577 

555 

1669 

151.87 

1983 

659 

619 

1919 

157.50 

2282 

742 

675 

2173 

163.12 

2533 

837 

752 

2  39  4 

168.75 

2667 

940 

875 

2561 

174.37 

2636 

1033 

1058 

2677 

180.00 

2430 

1089 

1298 

2769 
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TABLE  7.  CRUISE  FLIGHT  LOADS  @  V„ 

ri 

THREE  ACTUATORS  OPERATING/TWO 

ADJACENT  BYPASSED 

AZIMUTH 

IAP 

OMEGAT 

Rl 

R2 

R3 

0.00 

1259 

285 

1671 

5.62 

1065 

437 

1659 

11.25 

872 

527 

1646 

16.87 

693 

546 

1622 

22.50 

522 

516 

1568 

28.12 

335 

476 

1466 

33.75 

10  8 

465 

1313 

39.37 

-170 

497 

1133 

45.00 

-480 

555 

974 

50.62 

-775 

590 

89  8 

56.25 

-991 

540 

958 

61.87 

-1069 

356 

1181 

67.50 

-973 

18 

1558 

73.12 

-701 

-457 

2047 

78.75 

-285 

-1023 

2584 

84. 37 

224 

-1618 

3100 

90.00 

765 

-2175 

3533 

95.62 

1280 

-2638 

3815 

101.25 

1724 

-2958 

(*5972) 

106.87 

2062 

-3105 

112.50 

2274 

-3065 

3752 

118.12 

2356 

-2846 

3423 

123.75 

2321 

-2482 

3008 

129.37 

2201 

-2031 

2571 

135.00 

2040 

-1564 

2176 

140.62 

1884 

-1144 

1875 

146.25 

1765 

-812 

16  89 

151. 87 

3.69  5 

-570 

1611 

157.50 

1656 

-395 

1607 

163.12 

1619 

-243 

1637 

168.75 

1548 

-81 

1665 

174.37 

1427 

101 

1676 

180.00 

1259 

285 

1671 
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TABLE  8.  MANEUVER  LOADS  @  0 . 6VH 

FOUR  ACTUATORS  OPERATING/ONE  FAILED  HARDOVER 


AZIMUTH 


IAP 


OMEGAT 

R1 

R2 

R3 

R4 

0.00 

-2706 

2142 

2255 

-2524 

5.62 

-2893 

2138 

2403 

-2466 

11.25 

-3143 

2084 

2553 

-2382 

16.87 

-3412 

1975 

2684 

-2262 

22.50 

-3680 

1806 

2776 

-2105 

28.12 

-3926 

15  80 

2814 

-1923 

33.75 

-4135 

1305 

2787 

-1730 

39.37 

-4293 

997 

2690 

-1545 

45.00 

-4384 

6  80 

2525 

-1389 

50.62 

<^4  39  7} 

387 

2306 

-1281 

56.25 

^T3T7 

154 

2054 

-1242 

61.87 

-4185 

13 

1798 

-1287 

67.50 

-3997 

-17 

1569 

-1422 

73.12 

-3799 

61 

1391 

-1640 

78.75 

-3625 

227 

1278 

-1919 

84.37 

-3497 

446 

1229 

-2225 

90.00 

-3419 

677 

12  30 

-2522 

95.62 

-3383 

89  3 

1264 

-2780 

101.25 

-3370 

10  76 

1314 

-2983 

106.87 

-3365 

1226 

1371 

-3129 

112.50 

-3359 

1352 

1432 

-3229 

118.12 

-3352 

1464 

1499 

-3294 

123.75 

-3341 

1568 

1575 

-3329 

129.37 

-3323 

1664 

1657 

-3334 

135.00 

-3285 

1748 

1737 

-3302 

140.62 

-3212 

1815 

1805 

-3228 

146.25 

-3098 

1868 

1856 

-3117 

151.87 

-2949 

1912 

1892 

-2982 

157.50 

-2789 

1957 

1922 

-2845 

163.12 

-2653 

2007 

1962 

-2726 

168.75 

-2581 

2062 

2028 

-2636 

174.37 

-2596 

2112 

2126 

-2573 

180.00 

-2706 

2142 

2255 

-2524 
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TABLE  9. 

MANEUVER  LOADS  @ 

THREE  ACTUATORS 

°-6vh 

OPERATING/TWO  ADJACENT 

BYPASSED 

AZIMUTH 

IAP 

OMEGAT 

Rl 

R2 

R3 

0.00 

2764 

-1458 

2859 

5.62 

2449 

-1002 

2725 

11.25 

1999 

-455 

2564 

16.87 

1454 

111 

2415 

22.50 

853 

6  35 

2305 

28.12 

231 

1071 

2241 

33.75 

-380 

1384 

2225 

39.37 

-942 

1543 

2251 

45.00 

-1404 

1529 

2315 

50.62 

-1715 

1333 

2409 

56.25 

-1833 

970 

2517 

61.87 

-1743 

486 

2613 

67.50 

-1469 

-45 

2665 

73.12 

-1070 

-542 

2645 

78.75 

-623 

-937 

2541 

84.37 

-199 

-1194 

2363 

90.00 

156 

-1319 

2145 

95.62 

428 

-1345 

1924 

101.25 

630 

-1317 

1734 

106.87 

787 

-1270 

1593 

112.50 

921 

-1219 

1499 

118.12 

1044 

-1164 

1443 

123.75 

1165 

-1106 

1418 

129.37 

1290 

-1055 

1432 

135.00 

1435 

-1038 

1502 

140.62 

1619 

-1087 

1648 

146.25 

1856 

-1220 

1874 

151.87 

2142 

-142-7 

2157 

157.50 

2446 

-1656 

2455 

163.12 

2715 

-1834 

2709 

168.75 

2888 

-1887 

2871 

174.37 

2912 

-1765 

djESD 

180.00 

2764 

-1458 

2859 
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Each  IAP  contains  the  hydraulic  and  electrical  components,  as 
shown  in  Figure  15.  If  one  of  the  five  IAPs  jammed,  the  swash- 
plate  would  be  restricted  in  its  response  and  normal  travel. 

The  geometry  of  the  STAR  control,  however,  provides  a  possi¬ 
bility  of  breaking  the  jam  by  using  the  combined  force  output 
of  the  other  IAPs.  The  success  of  breaking  the  jam  is  de¬ 
pendent  upon  the  material  properties  and  design  characteris¬ 
tics  of  the  IAP. 

Figure  16  depicts  the  cross  section  of  an  IAP  which  exposes 
the  piston  head,  piston  rod,  and  cylinder  barrel.  The  slotted 
piston  head  would  be  fabricated  from  high  tensile  strength 
(260-290  ksi)  steel.  The  piston  and  barrel  would  be  made 
frangible  so  as  to  break  upon  impact  with  high  caliber  projec¬ 
tiles.  The  barrel  may  utilize  fibrous  material  in  an  epoxy  or 
metal  matrix. 

When  fully  developed,  these  concepts  will  do  much  to  minimize 
the  threat  of  ballistic  jam  (see  Section  4.3.4). 

2. 2. 5. 3  Hydraulic  Supply.  The  hydraulic  power  for  each  IAP 
is  derived  from  a  dedicated  pump  driven  from  the  main  rotor 
transmission.  A  cross  section  of  the  installation  is  shown  in 
Figure  17.  The  pump  is  a  3000  psi  variable  displacement  type 
that  supplies  2.0  gpm  at  4000  rpm. 

In  addition  to  the  dedicated  hydraulic  pump,  there  is  an 
auxiliary  pump  that  is  used  for  ground  checkout  and  fill  and 
bleed.  The  total  hydraulic  installation  for  the  pumps/I APs  is 
shown  in  Figure  18. 

2. 2. 5. 4  Fill-and-Bleed  Procedure.  Hydraulic  systems  require 
servicing  provisions  for  filling,  bleeding,  and  ground  check¬ 
out.  This  is  normally  accomplished  by  providing  a  set  of 
self-sealing  quick  disconnects  that  allows  a  hydraulic  ground 
cart  to  be  connected  to  the  system.  Since  each  IAP,  along 
with  its  dedicated  hydraulic  pump,  is  a  separate  system,  it 
would  not  be  practical  to  provide  five  separate  sets  of  quick 
disconnects . 

The  baseline  MUT  vehicle  contained  an  auxiliary  hydraulic 
system  powered  by  a  400-cycle  electric-motor  driven  pump.  This 
system  was  used  for  the  landing  gear  kneeling  function  and 
also  served  as  a  backup  system  for  the  flight  controls.  This 
system  has  been  retained  for  the  landing  gear  kneeling  func¬ 
tion.  Provisions  incorporated  in  the  IAPs  allow  use  of  this 
auxiliary  system  for  filling,  bleeding,  and  ground  checkout. 
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Figure  16.  TAP  anti jam  provisions. 


Figure  17.  Installation  drawing  for  STAR  hydraulic  pump 
and  electrical  alternator. 


-FORWARD  ACCESSORY 
\OUTPUT  $  9.000  RPM 


-HYDRAULIC  PUMP  DRIVES 
CAN  DC  REVOLVED  A80UI 
MAST  $  TO  ANY  POSITION 
BUT  WILL  REMAIN  EQl  S? 


TAIL  ROTOR  OUTPUT  C 


Figure  18.  Sketch  of  dedicated  and  auxiliary  hydraulic  lines. 
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The  provisions  added  to  the  IAP  include  a  solenoid  valve  that 
allows  the  auxiliary  hydraulic  system  to  pressurize  the  IAP 
and  a  fluid  tight  reservoir  overflow  connection  that  allows  a 
fluid  return  from  the  IAP  to  the  auxiliary  reservoir.  A 
sketch  of  the  layout  is  shown  in  Figure  19.  When  the  trans¬ 
mission-driven  pumps  are  operating,  a  bias  spring  prevents  the 
solenoid  valve  from  opening  and  auxiliary  pump  pressure  is  not 
available  to  the  IAP.  Anytime  the  IAP  reservoir  drops  below 
100  percent  full,  the  mechanically  operated  reservoir  overflow 
valve  closes  and  fluid  cannot  leave  the  IAP.  This  means  that 
the  fill-and-bleed  lines  are  isolated  and  not  vulnerable 
during  flight. 

The  following  procedure  would  be  used  for  fill  and/or  ground 
checkout: 

-  Turn  motor/pump  on. 

-  Engage  IAP  solenoids. 

-  Operate  collective  and  cyclic  sticks  so  that  each  IAP  is 
exercised  through  full  stroke  (10  times  minimum)  to  bleed 
system.  (Note:  If  pressure  does  not  build  up,  some 
malfunction  exists  in  one  or  more  IAPs.  Malfunction  may 
be  isolated  by  switching  off  the  IAPs.  Do  not  switch  off 
more  than  2  IAPs  at  one  time.) 

-  Operate  system  as  required  for  checkout. 

-  Turn  motor/pump  off. 

-  Check  that  all  IAP  reservoirs  are  at  least  90  percent 
full. 

The  following  bleed  procedure  with  rotor  turning  would  be  re¬ 
quired  on  initial  installation,  or  anytime  a  pump  or  IAP  has 
been  changed: 

-  Complete  ground  check  before  turning  rotor. 

-  Start  rotor. 

-  Observe  that  all  pumps  develop  pressure  and  all  IAP 
reservoirs  stay  above  20  percent.  If  not,  stop  rotor. 

-  Operate  collective  and  cyclic  sticks  to  the  maximum 
extent  possible  with  rotor  turning  so  that  each  IAP  is 
exercised  several  times. 

-  Stop  rotor. 

-  Repeat  ground  check  procedure. 
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2.2.6  Electrical  and  Electronic  System 

The  electrical  and  electronic  requirements  for  the  fly-by-wire/ 
light  system  mechanization  are  satisfied  by  utilizing  common 
helicopter  electrical  supply  hardware,  additional  dedicated 
alternators,  and  various  electronic  black  boxes  and  modules. 

2. 2. 6.1  Electrical  Supply  Schematic.  The  electromechanical 
actuators  used  m  the  horizontal  stabilizer  and  tail  rotor 
mechanization  require  redundant  electrical  power  sources.  Two 
power  sources  used  are  the  AC  buses  of  the  MUT  helicopter. 

Power  from  these  buses  is  converted  to  dc  by  two  transformer/ 
rectifiers.  A  third  source  of  dc  power  is  the  ship's  battery. 
Dedicated  alternators,  shown  in  the  installation  drawing  Figure 
17,  provide  dedicated  power  to  the  IAP  electronics  modules. 
Characteristics  of  the  alternator  are  shown  in  Figure  19. 

Prior  to  reaching  engine  idle  speed,  power  for  the  module  is 
provided  from  the  ship's  battery.  Automatic  switch-over 
occurs  when  alternator  voltage  exceeds  battery  voltage.  The 
electrical  supply  layout  is  depicted  in  Figure  20. 

2. 2. 6. 2  Electronic  Module  Characteristics.  Early  in  the  pre¬ 
design  effort,  two  candidate  configurations  were  considered 
for  the  STAR  channel  implementation.  Conceptually,  these  are 
shown  in  Figure  21.  The  fundamental  difference  between  the 
two  concepts  consists  of  the  location  and  physical  character¬ 
istics  of  the  electronic  module  (EM).  In  one  case,  the  module 
is  mounted  directly  to  the  IAP  and,  in  effect,  becomes  a  part 
of  the  IAP  assembly.  In  the  other  case,  the  module  is  located 
remote  to  the  IAP  and  must  be  electrically  connected  to  the 
various  IAP  valves  and  sensors  through  multiple  electrical 
connections.  The  advantage  of  the  IAP-mounted  module  is  the 
significant  inherent  immunity  to  EMI,  EMP,  and  lighting  noise 
due  to  the  use  of  fiber  optic  signal  input  and  the  elimination 
of  exposed  metallic  signal  interconnect  wires  between  the 
electronic  module  and  the  IAP. 

Design  analyses  indicate  that  IAP-mounted  electronics  are 
indeed  feasible  and  are  therefore  proposed  for  the  fly-by- 
wire/light  mechanization.  Thermal  analysis  for  a  U-shaped 
module  is  shown  in  Table  10.  The  shape  was  selected  because 
it  provides  a  reasonable  volume  and  a  large  amount  of  surface 
area  for  heat  dissipation  while  staying  inside  the  allowable 
IAP  envelope  for  all  mounting  positions.  Since  the  mounting 
surface  on  the  actuator  will  be  at  a  high  temperature,  thermal 
insulators  will  be  used  between  the  actuator  and  the  EM 
package. 


54 


SENSORS 


SHLD  CABLE 


TABLE  10.  ELECTRONICS  MODULE  THERMAL  ANALYSIS 


A  plug-in-type  electrical  connector  will  be  located  at  the 
bottom  of  the  electronic  module.  This  connector  will  be  used 
to  take  three-phase  ac  power  and  28  VDC  power  into  the  module 
and  to  provide  the  interconnect  between  the  electronic  module 
and  the  actuator  for  transfer  of  LVDT  excitations,  LVDT  posi¬ 
tion  information,  EHSV  command  lines,  and  pressure  transducer 
information.  The  chassis  connector  design  was  selected  to 
eliminate  external  wires,  thus  reducing  EMI  susceptibility. 

The  physical  design  characteristics  of  the  electronic  module 
package  design  are  driven  by  the  high  temperature  environment 
that  will  be  encountered  and  by  the  relatively  small  volume 
available.  Hybrid  electronic  packages  are  used  to  provide  the 
density  needed.  The  packages  are  mounted  on  multilayer  printed 
wiring  boards  with  extensive  on-board  heat  sinking.  The  cir¬ 
cuit  boards  slide  into  metallic  rails  on  the  side  of  the 
chassis  to  provide  good  thermal  conduction  to  the  chassis.  A 
motherboard  design  with  slide-in  connectors  will  provide  all 
the  required  board-to-board  interconnections.  Access  to  the 
circuit  cards  is  provided  through  a  removable  top  cover  on  the 
electronic  module  package.  The  power  converter  will  be  mounted 
in  one  of  the  "legs"  of  the  U-shaped  box  in  conjunction  with 
the  power  connector  interface  with  the  actuator. 

The  internal  circuitry  of  the  electronic  module  includes  a 
rectifier  and  voltage  regulator  for  the  dedicated  alternator, 
logic  circuitry  to  switch  from  battery  to  alternator  power 
when  alternator  has  sufficient  rpm,  optical  encoder/decoding 
circuitry,  electronic  servoloop  circuitry  for  controlling  the 
IAP  electrohydraulic  servovalve,  monitor  and  IAP  bypass  con¬ 
trol  circuitry,  and  circuitry  to  provide  display  information. 

The  block  diagram  of  Figure  22  depicts  the  relationship  of  the 
various  circuits  housed  in  the  electronic  module.  Detailed 
schematics  are  shown  in  Figures  23  through  28.  To  adequately 
house  the  circuitry  in  a  small  package,  a  number  of  hybrid 
circuits  are  considered. 

Figure  12  depicts  the  block  diagram  of  the  entire  ASH  mission 
FBW/L  control  system.  A  typical  electronic  module  interfaces 
with  the  other  system  components  and  assemblies,  as  shown  in  : 
Figure  29.  Control  inputs  are  derived  from  two  sources.  One 
source  is  the  pilot's  control  motion  input.  The  other  source 
is  the  control  augmentation  input.  Control  input  is  provided 
from  dualized  sensors  over  direct  link  fiber  optic  cables. 
Control  augmentation  input  is  provided  from  dual  computers 
via  Multiplex  Remote  Terminal  Units  ( MRTU ) .  The  dual  com¬ 
puters  are  self-monitoring  and  communicate  with  each  other 
via  MRTUS  over  dualized  MIL-STD-1553B  data  buses. 
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ELECTRONICS  MODULE 


Figure  22.  Architectural  structure  of  the  IAP  electronics  module 


ALL  CAPACITANCES  IN  FARADS 
ALL  RESISTANCES  IN  OHMS 
ALL  VOLTAGES  IN  VOLTS 


PARALLEL  CYCLIC 
STICK  COMMAND 


PARALLEL  COLLECTIVE 
STICK  COMMAND 


AXIS  VALID 
AND  SCAS 
VALID  DISCRETES 


O  PI  P3  P5  P7 
_lJp^P2  P 4  P6  P8 

J1  ‘  CD4021  so  3_ 

H  CK _ 

10 


7|6l  5|4|l3ll4]l5lil 

VW5P6"P8 
11  CD4021 


7|6|5|4|  13|l4lS|l| 

9pT‘p2P3P4  P5P6 P7P8 
—  P/S 

CD4021 


110  |  11  114  ^ 

i  o]i_ 

3m  54121  0  — 

A2 

74T7 


Figure  23.  SCAS  transmitter  electronics  -  two  of  these  per 
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Figure  24.  SCAS  electronics  receiver  and  decoder  - 
two  of  these  per  IAP. 
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Figure  25.  SCAS  receiver  electronics  -  two  of  these  per  IAP. 
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Figure 


Figure  29 .  Typical  STAR  IAP  electronics  module  interface 


A  three-fiber  connector  is  used  for  interfacing  with  the 
passive  sensors  to  provide  for  transmission  and  reception  of 
optic  pulses.  Sync  pulses  will  be  generated  in  the  elec¬ 
tronic  module  and  transmitted  through  dual  optic  lines  to 
the  passive  sensor.  The  sensor  will  then  encode  the  pulse 
into  -serial  digital  data  that  will  return  to  the  electronic 
module  through  a  third,  time-shared,  optic  line.  The  elec¬ 
tronics  will  then  decode  the  data  for  use  in  the  servoamp. 

A  two-fiber  connector  is  used  for  interfacing  the  electronic 
module  unit  with  the  control  augmentation  computers  to  provide 
both  a  transmit  and  a  receive  line.  A  dual  set  of  connectors 
is  provided  to  interface  with  the  dual  control  augmentation 
computers.  The  encoded  digital  data  from  the  stick  sensors 
and  the  actuator  valid  discretes  are  transmitted  from  the 
electronic  module  to  the  control  augmentation  computers  over 
the  optic  lines.  The  signals  received  from  the  control 
augmentation  computers  by  the  electronic  module  include  con¬ 
trol  augmentation  serial  data,  control  augmentation  fail 
discretes  from  the  control  augmentation  monitors,  and  inter¬ 
channel  logic  data  from  the  other  STAR  actuators. 

These  multifiber  connectors  will  be  so  designed  as  to  afford 
hermetic  seals  at  the  interface  with  the  electronic  module. 

The  proposed  connector  is  a  form  of  a  flat  connector.  The 
shell  is  standard,  but  the  rubber  or  plastic  insert  is 
replaced  with  optically  linear  fiberglass.  This  type  of  glass 
would  preclude  dispersion  of  the  optrc  signal  in  other  than 
the  desired  direction.  The  LED  or  detection  diode  used  for 
the  fiber  optic  link  will  be  mounted  directly  onto  the  glass 
window.  Placement  of  the  diode  will  be  made  for  proper 
alignment  with  the  mating  fiber  optic  connector  pins.  Wires 
will  be  connected  from  the  diodes  to  the  substrate  of  the 
hybrid  circuits  where  active  coding  or  decoding  are  mounted. 
The  hybrid  circuits  are  in  turn  mounted  on  the  circuit  boards 
in  the  module  so  that  the  connectors  can  protrude  from  the 
case  of  the  electronic  module.  The  mating  connector  will 
have  optic  fiber  sleeves  mounted  in  the  insert,  rather  than 
wire  crimp  pins.  The  fibers  will  protrude  from  the  end  of  the 
sleeve  and  mate  with  the  glass  window  aligned  with  the 
appropriate  diode  on  the  opposite  side. 

Control  augmentation  is  maintained  after  a  single  computer 
failure.  Control  augmentation  is  lost  after  a  second  computer 
failure.  This  loss  does  not  affect  the  pilot's  direct  control 
link. 


2. 2. 6. 3  Passive  Sensor  Design  and  Operation.  For  simplicity 
of  description,  a  single  channel  of  operation  of  the  dual¬ 
passive  optical  sensor  (DPOS)  is  first  provided.  Dual-channel 
operation  is  then  covered. 
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2. 2. 6. 3.1  Single-Channel  Operation.  With  reference  to  Figure 
30,  two  optical  data  lines,  corresponding  to  the  source  signal 
from  the  EM  and  the  return  signal  to  the  EM,  are  connected  to 
the  DPOS  via  two  optical  connectors.  The  source  signal  con¬ 
sists  of  a  22-nanosecond  pulse  sequence  with  a  period  of  one 
millisecond.  The  return  signal  consists  of  a  10-bit  digital 
word  of  330  nanosecond  duration,  gray-code  modulated  in  accord¬ 
ance  with  the  DPOS  shaft  position. 

The  source  signal  is  optically  coupled  into  ten  parallel 
optical  lines,  which  in  turn  connect  to  the  read/write  head 
for  the  encoder  disk.  Each  of  the  lines  has  a  different 
length,  which  results  in  different  time  delays  in  each  line 
relative  to  the  original  source  pulse.  The  delays  are  related 
by  a  constant  factor,  i.e.,  line  1  has  zero  nanosecond  delay, 
line  2  has  16.5  nanosecond  delay,  line  3  has  33  nanosecond 
delay.  Each  successive  line  has  an  incremental  16.5  nanose¬ 
cond  delay.  The  tenth  line  has  148.5  nanosecond  delay. 

Encoding  the  incoming  signal  is  achieved  by  reflecting  the 
source  illumination  back  into  the  10  parallel  data  lines,  each 
causing  an  additional  delay  to  the  reflected  pulse.  For 
example,  total  delay  in  line  1  is  zero,  that  in  line  2  is  33 
nanosecond,  line  3  delay  is  66  nanoseconds,  etc.  In  this 
manner,  the  pulse  reflected  to  the  tenth  line  is  delayed  297 
nanoseconds  relative  to  the  leading  edge  of  the  source  pulse. 
When  the  pulses  are  recombined  into  a  single  data  line,  a  10- 
bit  serial  word  is  obtained.  This  data  word  is  returned  to 
the  EM,  decoded,  and  summed  with  augmentation  and  servofeedback 
signals  to  form  a  servoamplifier  command. 

2. 2. 6. 3. 2  Dual  Channel  Operation.  The  operation  in  each 
channel  is  identical  to  that  described  above,  while  certain 
functions  are  duplicated  to  provide  dual  outputs  for  a  single 
shaft  input.  Dual  elements  consist  of  source/return  connec¬ 
tors  (4),  source/return  couplers  (2),  source/return  parallel 
delay  line  sets  (2),  and  read/write  encoder  heads  (2). 

With  the  nominal  velocity  of  light  of  2  x  10  meters/second  in 
the  fiber,  an  effective  delay  line  length  of  59.4  meters  is 
required  for  the  tenth  line  to  achieve  the  297  nanosecond 
maximum  delay.  As  described  above,  this  delay  is  actually 
achieved  with  a  29.7  meter  line  by  using  the  same  delay  line 
for  both  incoming  and  reflected  pulses.  If  a  1.7-inch  coil 
diameter  is  assumed,  219  turns  are  required  for  the  tenth  line 
delay. 

Failure  rate  of  the  DPOS  is  estimated  to  be  32  per  million 
hours.  Weight  is  estimated  to  be  2.2  pounds. 
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Figure  30.  Cross  section  of  dual  channel  passive  encoder. 


2. 2. 6. 4  Multiplex  Bus.  A  multiplex  system  provides  a  struc¬ 
tural  architecture  for  data  transfer  between  helicopter  sub¬ 
systems.  Instead  of  each  signal  having  its  own  dedicated 
communication  path,  all  signals  share  a  common  communication 
link.  Each  subsystem  line  replaceable  unit  (LRU)  is  either 
connected  directly  to  a  data  bus  or  wired  to  a  multiplex 
remote  terminal  unic  (MRTU)  located  nearby.  Information  from 
an  LRU  that  is  to  be  sent  to  other  parts  of  the  aircraft  is 
assembled  to  form  one  or  more  digital  words.  These  words  are 
sent  along  a  data  bus  that  connects  all  the  MRTUs  and  compati¬ 
ble  LRUs  together.  As  a  result,  the  bulk  of  information 
transfer  between  LRUs  travels  over  the  data  bus  instead  of  a 
large  number  of  individual  wires.  The  high  speed  of  the 
multiplex  system  provides  for  data  sorting,  storage,  and 
manipulation  without  degradation  of  signal  quality.  Hence, 
the  presence  of  the  multiplex  system  is  'transparent'  to  the 
LRUs  it  services. 

Data  transfers  between  LRUs  and  MRTUs  are  controlled  by  one  or 
more  bus  controllers.  The  bus  controller  is  a  minicomputer 
located  inside  one  of  the  MRTUs.  The  controller  issues  a  com¬ 
mand  to  an  LRU  telling  it  to  receive  data,  send  required  data 
back,  or  transfer  data  from  one  LRU  to  another.  No  data 
transfers  take  place  on  the  data  bus  except  by  command  of  the 
bus  controller. 

A  valuable  feature  of  a  multiplex  system  is  its  ability  to 
perform  the  function  of  (and  eliminate  the  need  for)  many 
subsystem  LRUs.  This  benefit  comes  about  because  the  bus  con¬ 
troller  is  fast  enough  to  see  that  all  data  is  sent  to  and  re¬ 
ceived  by  the  proper  LRU  with  plenty  of  time  remaining  to  per¬ 
form  numerous  computations.  In  addition,  all  the  information 
needed  to  perform  the  computations  is  already  in  the  multiplex 
system,  ready  for  use  by  the  bus  controller. 

For  both  the  baseline  and  the  fly-by-wire  aircraft,  the  multi¬ 
plex  bus  is  expected  to  perform  the  following  functions: 

Control  Augmentation 

Stores  Management 

Navigation 

Nav/Comm  Radio  Management 

Fault  Detection  and  Isolation 

Integration  of  the  control  augmentation  functions  into  the 
multiplex  bus  system  is  readily  accomplished,  since  most  of 
the  data  required  for  these  functions  are  already  on  the  bus. 

The  integration  of  the  flight  control  system  with  the  multi¬ 
plex  bus  during  the  initial  system  design  ensures  that  the  bus 
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structure  will  provide  the  iteration  rate  and  data  sample  rate 
required  for  the  control  augmentation  functions.  This  is  a 
particularly  important  factor  in  the  design  of  the  flight  con¬ 
trol  system,  since  the  iteration  rate  selected  must  be  high 
enough  to  obtain  the  system  bandwidth  necessary  for  the  high- 
frequency,  inner  loop  command  augmentation  computations. 

The  multiplex  bus  system  provides  a  practical  means  of  inter¬ 
connecting  digital  systems  in  an  organised  and  structured  manner. 
The  concept  was  originally  conceived  to  save  wiring  weight 
in  aircraft.  Today,  however,  multiplexing  is  recognized  as  a 
powerful  tool  that  offers  a  significant  degree  of  integration 
and  flexibility. 

The  use  of  multiplex  dictates  an  integrated  approach  to  avionics 
system  design.  Communication  between  avionics  components  is 
established  in  a  centralized  manner.  Control  and  computation, 
on  the  other  hand,  may  be  distributed  throughout  the  system. 

The  distribution  need  not  be  functional,  but  may  be  topologi¬ 
cal,  as  best  fits  the  aircraft  configuration.  These  key  con¬ 
siderations  lead  to  significant  advantages. 

-  Crew  capabilities  are  enhanced  -  the  multiplex  system 
allows  an  integrated  approach  to  control  and  display. 

This  approach  allows  maximum  use  of  human  factor  princi¬ 
ples  to  reduce  operator  workload. 

-  Weight  is  reduced  -  an  original  goal  of  multipTex  is 
achieved  in  reduced  wiring  weight  and,  more  importantly, 
in  reduced  special-purpose  panels  and  displays. 

-  Survivability  is  increased  -  the  combination  of  central¬ 
ized  communication  and  distributed  control  permits  the 
system  to  automatically  reconfigure  and  select  reversion¬ 
ary  modes  of  operation  in  case  of  failures  or  battle  damage. 
In  many  cases,  the  reconfiguration  can  be  accomplished 
without  any  oerformance  degradation. 

-  Flexibility  is  built  in  -  the  integrated  systems  design 
approach  coupled  with  enforced  communication  standards 
will  allow  new  equipment  to  be  installed  without  major 
aircraft  rewiring. 

-  Multiplex  reduces  development  risk  -  the  distributed 

or  approach  to  control  changes  many  system  para- 
Ta*' ..  .rom  hardware  consideration  to  software. 

2 . 2 . 6 . 5  Preflight  Test  of  Main  Rotor  Controls  Using  the 
Multiplex  Bus.  The  multiplex  bus  can  be  used  to  perform  pre¬ 
flight  checkout  of  the  iAP  electronic  module.  A  preflight  test 
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can  be  broken  down  into  two  steps:  verification  of  proper 
operation  of  the  IAP  and  verification  of  proper  operation  of 
the  IAP  monitor  functions.  Since  it  is  desirable  to  minimize 
the  amount  of  hardware  built  into  the  IAP  electronic  module 
strictly  for  test  purposes,  an  efficient  self-test  capability _ 
would  utilize  the  built-in  IAP  monitor  circuits  wherever  possi¬ 
ble.  The  control  augmentation  inputs,  therefore,  should  be 
used  to  verify  the  correct  operation  of  the  IAP  monitor  func¬ 
tions  that,  in  turn,  can  be  used  to  verify  correct  operation 
of  the  IAP  control  circuits. 

With  the  incorporation  of  a  few  components  into  the  digital 
decoder  circuits,  the  IAP  electronic  module  can  be  configured 
to  accept  a  self-test  command  from  the  computers.  This  com¬ 
mand  can  be  used  to  inhibit  the  transmission  of  light  pulses 
to  one  of  the  dual  stick  sensors,  thus  causing  a  mistrack  to 
occur  in  the  IAP  computations.  The  mistrack  will,  in  turn, 
cause  the  IAP  monitor  to  indicate  a  failed  condition.  This 
type  of  check  can  be  performed  on  both  channels  of  the  IAP 
using  the  computers.  In  addition,  the  computers  can  command 
an  individual  IAP  to  go  into  the  pressure  bypass  mode  through 
the  transmission  of  the  appropriate  commands.  Since  the  IAP 
status  is  transmitted  back  to  the  computers,  a  check  on  the 
receipt  and  proper  execution  of  this  type  of  command  can  be 
made.  The  ability  of  the  IAP  actuator  model  to  detect  im¬ 
proper  motion  in  the  actuator  can  also  be  checked  by  the 
computers.  For  this  test,  all  the  IAPs  are  commanded  to  the 
"on"  state  with  no  hydraulic  bypass  and  then  each  actuator, 
in  turn,  is  commanded  to  move  in  opposition  to  the  remaining 
four.  The  resulting  force  fight  should  preclude  any  signi¬ 
ficant  motion  of  the  actuator  under  test,  thus  causing  the 
actuator  model  and  monitor  circuits  to  indicate  a  failure. 
Again,  the  actuator  status  is  transmitted  back  to  the  SCAS 
computers  for  evaluation  by  the  pre flight  program. 

2. 2. 6. 6  EMI/EMP  Considerations .  The  fly-by-wire  system 
utilizes  liber  optic  transmission  for  all  data  paths.  The  di¬ 
electric  nature  of  the  light  conductors  provide  distinct  ad¬ 
vantages  in  immunity  to  EMI  caused  by  lightning  or  inductive 
fields,  RFI  caused  by  radar,  and  EMP  caused  by  nuclear  events. 
The  elimination  of  all  external  wires  through  the  use  of  the 
IAP  package  concept  has  been  a  driving  factor  in  the  design 
of  the  system.  Nevertheless,  the  various  electronic  assemblies 
themselves  are  subject  to  some  ECI  and  RFI  effects.  The  major 
factors  addressed  in  the  study,  therefore,  were  the  minimiza¬ 
tion  of  crosstalk  between  internal  wires  and  the  use  of  cir¬ 
cuit  techniques  to  minimize  the  effects  of  noise. 
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The  internal  wiring  design  minimizes  inductive  and  capacitive 
crosstalk  by: 

-  Maximizing  cable  spacing  between  generator  and  susceptor 
circuits.  Maximum  efforts  will  be  taken  to  separate 
digital,  analog,  power,  and  discretes. 

-  Minimizing  cable  spacing  above  chassis  to  enhance  capaci¬ 
tance  to  chassis. 

-  Routing  analog  signals  as  twisted  pairs  wherever  possible. 

-  Routing  all  primary  and  secondary  power  leads  as  twisted 
pairs  with  their  respective  returns  to  reduce  H-field 
radiation. 

-  Routing  all  digital  signals  in  a  multilayer  motherboard 
and  placing  a  shield  layer  between  digital  traces  and  the 
analog  back  plane  wire-wrap  leads. 

-  Routing  all  leads  point  to  point  in  the  wire-wrap  plane 
and  keeping  returns  adjacent  to  their  signal-carrying 
conductor . 

Particular  attention  should  be  directed  to  the  layout  and 
partitioning  of  printed  circuit  cards.  The  following  measures 
should  be  incorporated: 

-  Minimize  trace  lengths  of  high-frequency  clocks.  Locate 
high-frequency  devices  near  the  PC  board  connector. 

-  Employ  a  complete  ground  plane  and  locate  high-frequency 
and  power  traces  adjacent  to  plane  tc  maximize  capaci¬ 
tance  to  same. 

-  Provide  as  many  pins  as  practical  between  each  PC  board 
ground  plane  and  motherboard  ground  plane  for  all  digital 
boards.  A  minimum  of  two  is  considered  necessary. 

-  Where  analog  and  digital  devices  have  to  be  located  on 
the  same  board,  grouping  should  be  employed  to  minimize 
interaction.  During  A/D  conversion,  if  analog  and  digi¬ 
tal  references  must  be  commoned,  then  the  given  analog 
signal  should  be  returned  through  the  digital  plane. 
Digital  returns  should  never  be  referenced  to  analog. 

As  presently  planned,  only  isolated  A/D  devices  will  be 
employed  to  prevent  common  referencing  between  analog 
and  digital . 


3.  QUANTITATIVE  COMPARISON 


In  order  to  provide  information  necessary  for  assessment  of 
the  desirability  of  a  fly-by-wire/light  flight  control  system 
in  the  ASH,  the'  dual  mechanical  MUT,  as  configured  for  the  ASH 
mission,  is  quantitatively  compared  with  the  proposed  redun¬ 
dant  FBW/L  flight  control  system. 

3.1  VULNERABILITY 

In  the  following  paragraphs,  the  vulnerability  of  the  dual 
mechanical  and  fly-by-wire/light  systems  is  analyzed. 

3.1.1  Threat  Definition 

The  12.7mm  API  projectile  is  a  kinetic  energy  penetrator.  It 
is  designed  as  a  hard  steel  core  surrounded  by  an  outer  metal 
jacket.  An  incendiary  mixture  is  located  in  the  nose  of  the 
projectile  between  the  outer  jacket  and  the  steel  core.  The 
outer  jacket  is  designed  to  strip  away  at  first  impact,  ignit¬ 
ing  the  incendiary  mixture.  The  physical  characteristics  of 
the  intact  projectile  are: 

Length  2 . 54  inches 

Diameter  .51  inch 

Weight  745  grains 

For  this  analysis,  the  12.7mm  API  projectile  is  intact  and 

fully  aligned  at  first  impact  and  for  12  inches  after  first 
impact.  Impact  velocity  is  2000  feet  per  second.  Beyond 
this,  the  projectile  is  intact  and  30  degrees  tumbled  (yaw) 
giving  a  cutting  length  of  1.27  inches.  This  degree  of  tumble 
is  considered  to  be  realistic  for  the  scope  and  purposes  of 
this  study. 

The  23mm  HEI-T  projectile  has  four  basic  kill  mechanisms; 
intact  penetration,  blast  loading,  fragment  penetration  and 
incendiary  fires.  Blast  loading,  fragment  penetration  and 
intact  projectile  penetration  are  the  primary  kill  mechanisms 
for  flight  control  components.  The  projectile  is  designed 
such  that  upon  striking  a  target  a  fuse  is  activated,  igniting 
an  explosive  charge  that  fragments  the  outer  casing.  These 
fragments  and  the  blast  loads  from  the  explosive  penetrate  the 
target  material. 

The  ground-to-air  23mm  HEI-T  projectile  has  an  overall  length 
of  approximately  4.3  inches  and  a  diameter  of  .9  inch.  The 
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casing  is  made  of  48  percent  carbon  steel  with  copper  rotating 
bands.  The  fuse  assembly,  also  made  of  carbon  steel,  contains 
a  simple  arming  device  that'  is  actuated  by  acceleration  and 
centrifugal  forces.  Also  contained  within  this  assembly  is  a 
simple  self-destruct  mechanism  that  detonates  the  projectile  6 
to  10  seconds  after  firing.  The  explosive  charge  consists  of 
two  aluminized  RDX  pellets  that  have  a  combined  weight  of 
approximately  204  grains.  This  explosive  has  high-brisance 
characteristics  that  enhance  projectile  breakup. 

The  fragments  act  as  a  kill  mechanism  by  impacting  the  target 
at  high  velocity  and  removing  target  material.  The  kinetic 
energy  of  the  fragment  at  the  time  it  strikes  the  target  is 
one  measure  of  its  lethality.  For  projectiles  like  the  23mm 
HEI ,  the  fragment  mass  will  vary  from  less  than  one  grain  to 
over  100  grains.  The  striking  velocity  of  the  fragment  on  the 
target  material  will  be  the  vector  sum  of  the  intact  projec¬ 
tile's  forward  velocity,  angular  rotation  at  the  time  of 
detonation,  and  the  static  detonation  velocity  of  the  frag¬ 
ment.  Fragment  velocities  from  static  detonation  will  range 
from  about  200  to  over  3500  feet  per  second. 

Upon  detonation  of  the  explosive  charge,  the  high  pressure  and 
temperature  causes  the  explosive  gases  to  expand,  causing  the 
case  to  swell  until  the  failure  point  is  reached.  The  case 
then  fails  and  fragments  are  ejected  at  high  velocity.  The 
fragments  obtain  an  initial  velocity  and  form  a  burst  pattern 
that  depends  primarily  upon  the  physical  shape  and  velocity  of 
the  casing  before  explosion.  The  burst  pattern  of  the  shell 
is  considered  symmetrical  about  the  projectile's  longitudinal 
axis.  The  total  fragment  pattern,  for  representative  striking 
velocities,  is  contained  in  a  cone  forward  of  the  projectile. 
The  half  angle  of  the  cone  is  determined  by  the  resultant 
fragment  velocity.  For  typical  striking  velocities  of  projec¬ 
tiles,  such  as  the  23mm  HEI,  the  fragments  will  be  contained 
in  a  cone  with  a  half  angle  of  approximately  50  degrees. 

The  second  major  damage  mechanism  from  an  HEI  projectile  comes 
from  the  shock  or  blast  wave  that  propagates  from  the  projec¬ 
tile  explosion.  At  detonation,  most  of  the  explosive  charge 
within  the  projectile  is  immediately  converted  to  a  gaseous 
form.  These  gases,  at  high  temperatures  and  pressure,  expand 
against  the  casing  causing  rupture.  The  gases  also  compress 
the  surrounding  air  and  then  initiate  a  shock  wave  that  propa¬ 
gates  similar  to  a  sound  wave,  except  that  the  shock  wave 
travels  at  supersonic  velocity.  This  causes  an  abrupt  in¬ 
crease  in  pressure,  density,  temperature  and  air  particle 
velocity.  When  the  blast  wave  strikes  the  target  material,  it 
is  reflected,  setting  up  another  shock  wave  called  the  re¬ 
flected  shock  wave,  whose  intensity  is  greater  than  the  initial 
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wave.  However,  the  target  material  will  experience  only  a 
single  shock  because  the  reflected  wave  is  formed  instantane¬ 
ously.  Consequently,  the  value  of  the  overpressure  experienced 
by  the  target  material  is  generally  considered  to  be  entirely 
reflected  over-pressure  (Reference  4).  The  reflected  blast 
wave  thus  formed  is  capable  of  effecting  considerable  damage 
on  components  due  to  the  overpressure.  The  magnitude  of  this 
overpressure  decreases  as  an  exponential  function  of  the 
distance  from  the  center  of  the  explosive  charge,  and  is 
typically  measured  in  psi  over  atmospheric  pressure  as  a  func¬ 
tion  of  distance  from  the  center  of  a  reference  spherical 
charge . 

3.1.2  Methodology 

The  candidate  flight  control  systems  are  assessed  for  their 
vulnerability  to  the  12.7mm  API  and  23mm  HEI-T  threats.  A 
quantitative  analysis  is  performed  on  both  flight  control 
systems  for  the  12.7mm  API  threat;  however,  the  scope  of  this 
analysis  allows  only  a  qualitative  evaluation  of  the  23mm  HEI- 
T  threat.  The  vulnerability  analysis  first  requires  determin¬ 
ation  of  those  components  within  the  flight  control  systems 
that  are  critical  to  the  systems  operation.  This  is  a  func¬ 
tion  of  the  damage  states  being  analyzed,  threat  characteris¬ 
tics,  and  the  operating  condition  of  the  helicopter.  These 
components  are  classified  as  being  singly  vulnerable  or  multi¬ 
ple  vulnerable  to  the  threat.  That  is,  the  component  is 
singly  vulnerable  if  it  can  be  disabled  by  a  single  projectile 
hit.  An  engine  on  a  single-engine  aircraft  is  an  example  of  a 
component  in  this  category.  The  multiple  vulnerable  class  of 
components  requires  that  a  single  projectile  disable  more  than 
one  component  in  order  to  render  the  system  inoperable.  The 
engines  on  a  twin-engine  aircraft  are  an  example  of  this 
situation. 

The  major  components  in  the  flight  control  systems  that  are 
determined  to  be  critical  are  listed  as  follows: 

-  Push-pull  tubes  and  connectors 

-  Bellcranks,  idlers,  and  rocker  arms 

-  Mechanical  mixers 

-  Actuators 


'‘Walther,  Robert  E.,  et  al.,  AIRCRAFT  VULNERABILITY,  VOLUME  V  - 
FLIGHT  CONTROL  AND  HYDRAULIC  SYSTEMS,  Ballistic  Research  Labo¬ 
ratory  TR-02061,  Aberdeen,  Maryland,  May  1978,  Confidential. 
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-  Jackshafts 

-  Transducers 

These  components  may  be  either  singly  or  multiply  vulnerable 
depending  on  the  system  in  which  they  are  used. 

The  results  are  reported  as  a  difference  in  the  averaged 
vulnerability  of  the  five  viewing  aspects  of  the  fly-by¬ 
wire/light  control  system  and  the  dual  mechanical  control 
system  to  prevent  the  report  from  containing  classified  data. 

Within  the  areas  where  the  components  of  the  flight  control 
systems  are  redundant,  the  analysis  was  concerned  with  two 
items.  First,  what  is  the  probability  that  the  multiple 
vulnerable  components  will  be  made  inoperable  from  a  single 
hit?  Second,  what  is  the  probability  that  the  system  would 
fail  due  to  a  projectile  jamming  a  component?  This  second 
case  is  of  special  interest  to  the  dual  mechanical  control 
system. 

To  determine  the  first  part,  References  4  and  5  are  used  to 
obtain  the  required  separation  distance  to  minimize  the  possi¬ 
bility  that  redundant  tubes  would  be  rendered  inoperable  by  a 
single  projectile.  In  this  analysis,  Reference  6  is  used  to 
show  that  for  typical  boosted  compression  loads,  flight  control 
tubes  can  withstand  a  cut  across  the  tube  that  causes  loss  of  i 

61  percent  of  its  circumference.  In  some  cases,  the  tubes  ® 

could  take  as  high  as  75  percent  circumference  loss  and  sur¬ 
vive.  Using  this  information  and  assuming  an  average  tube 
diameter  of  1.125  inches,  the  probability  of  a  kill,  given  a 
hit,  was  determined  to  be  .1  for  a  separation  distance  of  2.8 
inches  and  .03  for  7.6  inches  separation. 

For  the  second  part,  each  flight  control  system  is  checked  for 
anti jam  devices  located  with  the  redundant  paths.  The  absence 
of  such  devices  would  make  the  redundant  components  within  that 
portion  of  the  system  singly  vulnerable  to  jamming.  Their 
condition  probability  of  kill  would  be  based  on  the  probability 
that  they  may  cause  the  system  to  jam. 


sFoulk,  James  B.,  A  MEASURE  OF  THE  EFFECT  OF  SEPARATION  OF 
PAIRED  REDUNDANT  COMPONENTS  ON  THE  VULNERABILITY  OF  AIRCRAFT 
TARGETS  TO  SINGLE  PENETRATORS,  Ballistic  Research  Laboratory, 
Report  Number  229,  Aberdeen  Maryland,  May  1974. 

6Crist,  J.  David,  and  Blaser,  Allen  N.,  HIGH  SURVIVABILITY 
FLIGHT  CONTROLS  DESIGN,  VOLUME  I  -  AH-lS  HELICOPTER  BALLISTIC- 
DAMAGE-TOLERANT  SUBSYSTEMS  PRELIMINARY  DESIGN,  USARTL  TR-77- 
49A,  Applied  Technology  Laboratory,  U.S.  Army  Research  and 
Technology  Laboratories  (AVRADCOM),  Fort  Eustis,  Virginia, 
February  1979,  ADB036946L. 
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Singly  vulnerable  kill  probabilities  are  estimated  using: 

-  Data  available  from  the  U.S.  Army  (Fort  Eustis  VAT  team 
and/or  Ballistic  Research  Laboratories) 

-  Results  from  previous  related  contracts 

-  BHT,  Sperry,  and  HRT  analytical  and  empirical  techniques 

Once  the  conditional  probabilities  are  quantified,  the  pre¬ 
sented  area  of  each  component  from  a  particular  attack  direc¬ 
tion  is  determined.  During  this  process  of  obtaining  presented 
areas,  it  is  necessary  to  consider  the  space  orientation  of 
the  individual  components  and  to  evaluate  any  masking  or 
shielding  from  major  components  onboard  the  aircraft. 

The  vulnerable  area  of  a  component  can  be  interpreted  as  an 
equivalent  area  which,  if  subjected  to  the  threat  damage 
mechanism(s ) ,  results  in  a  specified  level  of  damage.  More 
explicitly,  the  vulnerable  area  of  a  component  is  a  weighted 
value  of  the  presented  area  projected  onto  a  plane  normal  to 
the  trajectory  of  the  projectile,  where  the  weighting  factor 
is  the  probability  of  a  random  hit  defeating  (killing)  the 
component.  For  a  given  threat,  striking  velocity,  damage 
state,  and  viewing  aspect,  the  vulnerable  area  of  a  component 
can  be  calculated  by: 

AV  =  V  Pk/h 


the  vulnerable  area  of  the  component 

the  presented  area  of  the  component 

the  conditional  probability  of  damaging  the 
component,  given  a  hit 

Vulnerable  area  values  are  computed  for  the  front,  rear, 
bottom,  left  and  right  side  viewing  aspects  and  then  averaged. 

This  procedure  is  used  to  estimate  the  single-hit  vulnerable 
areas  of  the  fixed  control  systems  for  both  the  dual  mechani¬ 
cal  and  dual  fly-by-wire/light  designs.  Both  systems  are 
evaluated  for  attrition  kill  of  the  helicopter  while  in  hover 
flight  and  2/3  fuel  capacity. 

Typically,  vulnerable  area  analysis  for  the  high  explosive 
projectiles  are  determined  by  mapping  regions  about  the  compo¬ 
nent  where  it  is  vulnerable.  For  selected  viewing  aspects, 


where 

Av  = 

AP  = 
pk/h  = 
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these  regions  project  areas  that  are  usually  larger  than  the 
component's  presented  area'  for  that  aspect.  Development  of 
this  analysis  is  a  task  that  is  beyond  the  scope  of  this 
report.  Thus,  a  qualitative  analysis  of  the  above  described 
components  are  performed  for  the  23mm  HEI-T  threat. 

3.1.3  Comparison  of  Dual  Mechanical  and  Fly-By-Wire/Liqht 

Both  the  dual  mechanical  and  the  dual  fly-by-wire/light  flight 
control  systems  have  low  vulnerable  areas  to  the  12.7mm  API 
threat  for  a  helicopter  in  hover  flight.  The  fly-by-wire/ 
light  control  system  has  a  five-aspect  averaged  vulnerable 
area  that  is  .26  square  foot  less  than  the  five-aspect  aver¬ 
aged  vulnerable  area  for  the  dual  mechanical  control  system. 
This  difference  is  primarily  from  the  vulnerability  of  the 
main  rotor  actuators  within  the  two  systems. 

To  summarize,  the  dual  mechanical  flight  control  system  has 
excellent  survivability  to  the  12.7mm  API  projectile  and  good 
23mm  HEI-T  threat  survivability.  The  fly-by-wire/light  con¬ 
trol  system  also  has  excellent  survivability  to  the  12.7mm  API 
projectile  (slightly  better  than  the  dual  mechanical  system), 
and  good  23mm  HEI-T  threat  survivability.* 

3.2  CONTROL  SYSTEM  WEIGHT 

The  preliminary  design  effort  resulted  in  a  definition  of  the 
dual  mechanical  and  fly-by-wire/light  control  systems.  Figures 
5  and  13  identify  the  various  cranks,  tubes,  actuator,  support, 
etc.,  of  the  dual  mechanical  system.  These  were  tabulated  and 
compared  with  similar  parts  from  a  comparable  BHT  production 
helicopter  for  weight  estimation. 

3.2.1  Methodology  and  Assumptions 

To  meet  the  ASH  mission  requirements,  more  electronics  and 
control  augmentation  capability  were  added  to  the  basic  MUT 
control  system. 

The  fly-by-wire  concept  required  the  modification  of  the  main 
rotor  transmission  to  permit  the  installation  of  five  IAPs, 
along  with  their  dedicated  power  supplies.  Two  additional 
horns  for  the  nonrotating  swashplate  ring  were  also  required 
to  bring  that  total  to  five. 


*If  more  detailed  vulnerability  analysis  information  is 
required,  qualified  requestors  may  obtain  the  information 
from  Bell  Helicopter  Textron  with  the  approval  of  the 
Applied  Technology  Laboratory  Security  Manager. 
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Nonrotating  control  linkage  between  the  cockpit  and  the  main 
and  tail  rotors  was  removed.  This  was  performed  with  no 
weight  advantage  being  assessed  for  reduction  of  airframe 
structural  stiffness  that  is  no  longer  necessary  for  control 
backup . 

The  IAP  weight  was  furnished  by  Hydraulics  Research  Textron. 
The  dedicated  power  supplies  contain  off-the-shelf  Abex  hy¬ 
draulic  pumps  and  HTL  Electro-Kinetics  alternator  components. 
Mission  electronics  weight  is  furnished  by  Sperry  Flight 
Systems.  Transmission  drawing,  Figure  9,  shows  the  modifica¬ 
tion  necessary  to  adapt  to  FBW.  System  ground  check  and  other 
hydraulic  plumbing  required  is  shown  in  Figure  18. 

The  basic  MUT  dual  mechanical  system  utilizes  a  fly-by-wire 
horizontal  stabilizer  that  weighs  19  pounds.  BHT  uses  a 
similar  system  on  their  Model  2x4ST  and  estimates  its  weight 
for  the  MUT  to  be  essentially  the  same. 

The  tail  rotor  FBW  arrangement  is  shown  in  Figure  10  with  a 
total  system  weight  of  28.4  pounds.  This  is  apportioned  to 
17.4  pounds  at  the  tail  rotor,  6.5  pounds  of  wiring,  and  the 
remainder  in  the  cockpit  for  sensors  and  control  electronics. 

3.2.2  Analysis 

Conventional  sticks,  dual  linkage  including  rotating  controls, 
and  anti jam  devices  in  the  dual  mechanical  control  system  are 
136  pounds  heavier  than  the  conventional  sticks  and  rotating 
controls  of  the  fly-by-wire  system.  An  additional  15  to  20 
pounds  not  counted  here  could  be  saved  by  implementing  side- 
arm  controllers  in  the  cockpit. 

The  hydraulic  actuators  for  both  systems  are  designed  for  jam 
tolerance.  A  weight  increase  of  only  27.5  pounds  is  required 
to  replace  four  nonintegrated  actuators  in  the  dual  mechanical 
system,  with  five  integrated  actuators  in  the  FBW  system. 

The  hydraulic  power  supply  for  the  dual  mechanical  system  con¬ 
sists  of  two  independent  expanded  systems  complete  with 
separated  pump  cooler  units,  pump  drives,  reservoirs,  filters, 
modules,  manifolds,  accumulators,  switching  and  isolation 
values,  and  plumbing  and  associated  hardware.  The  FBW  hydrau¬ 
lic  system,  on  the  other  hand,  is  integrated  with  the  actuator 
that  is  located  next  to  its  dedicated  pump.  Components  allo¬ 
cated  to  hydraulic  supply  are  listed  in  Table  11.  The  inte¬ 
grated  concept  reduces  overall  hydraulic  system  weight  by  56 
pounds . 


85 


Both  the  dual  mechanical  and  fly-by-wire  control  systems 
require  electromechanical  actuators  for  the  autopilot  and 
horizontal  stabilizer.  Only  the  dual  mechanical  controls  use 
electromechanical  actuators  for  control  augmentation.  Only 
the  FBW  control  system  uses  electromechanical  actuators  for 
tail  rotor  control.  In  this  category,  the  fly-by-wire  system 
is  1.4  pounds  heavier. 

The  FBW  system  uses  a  dedicated  electrical  alternator  for  each 
control  channel  of  the  main  rotor.  This  power  is  in  addition 
to  the  ship's  normal  electrical  supply  system.  In  addition, 
both  the  dual  mechanical  and  the  FBW  systems  have  electrical 
supply  processing  equipment  that  rectifies,  regulates,  and/or 
interfaces  the  various  electronic  systems  with  their  power 
supply  source.  These  are  listed  and  compared  in  Table  11. 

The  FBW  is  16.5  pounds  heavier  in  this  category  than  the  dual 
mechanical  system. 

In  the  category  of  sensor  and  control  signal  electronics,  the 
FBW  is  only  4.5  pounds  heavier  than  the  dual  mechanical  system. 
Part  of  this  is  allocated  to  the  fact  that  separate  SCAS  elec¬ 
tronics  was  used  for  the  dual  mechanical,  whereas  the  function 
was  incorporated  into  the  computer  system  for  the  FBW  system. 

3.2.3  Weight  Comparison  of  Dual  Mechanical  and  FBW  Systems 

Table  11  lists  the  tabulated  comparison  of  the  control  system 
weight  for  the  dual  mechanical  system  and  the  FBW  system. 

From  the  table,  it  is  seen  that  the  FBW/L  system  is  143  pounds 
lighter  than  the  dual  mechanical  control  system.  It  is  noted 
that  conventional  cockpit  sticks  are  assumed  here.  Additional 
weight  can  be  saved  by  adopting  advanced  cockpit  controls. 

These  are  discussed  in  Section  5. 

3.3  LIFE-CYCLE  COSTS 

Complete  life-cycle  cost  analyses  include  every  cost  item 
associated  with  the  system  or  subsystem  under  consideration. 

The  costs  are  generally  broken  into  the  following  categories: 

-  RDT&E 

-  Nonrecurring  Initial  Investment 

-  Recurring  Initial  Investment 

-  Cr-eratuons  and  Maintenance 
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TABLE  11.  CONTROL  SYSTEM  WEIGHT  COMPARISON 


Category 

Dual  Mechanical 
(pounds) 

FBW/L 

(pounds) 

Sticks/linkages 

*  Main  Rotor  Rotating 

178.0 

178.0 

*  Tail  Rotor  Rotating 

12.5 

12.5 

•  Nonrotating 

231.2 

95.0 

Subtotal 

421.7 

285.5 

Actuators,  Hydraulic 

*  Main  Rotor 

75.0 

112.5 

•  Tail  Rotor 

10.0 

0.0 

Subtotal 

85.0 

112.5 

Power  Supply,  Hydraulic 

•  Pumps,  misc. 

131.0 

37.8 

♦  Mechanical  drives  for 
FBW/L 

0.0 

36.9 

Subtotal 

131.0 

74.8 

Actuators,  Electromech. 

•  SCAS 

16.0 

0.0 

•  Elevator 

14.0 

14.0 

•  Tail  Rotor 

C  .0 

17.4 

•  Autopilot 

8.0 

8.0 

Subtotal 

38.0 

39.4 

Electrical  Cables, 

Hardware,  &  Alternators 

16.0 

32.5 

Sensors,  Signal  Processing 

Components 

84.4 

88.9 

Total 

776.1 

633.5 
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3.3.1  Methodology 

The  methodology  used  to  provide  a  comparison  between  the  FBW 
and  dual  mechanical  flight  control  systems  centers  on  identi¬ 
fying  the  major  cost  items  in  which  differences  are  expected 
to  occur.  This  system  results  in  a  cost  difference  but  does 
not  provide  an  estimate  of  the  total  life-cycle  cost  for  each 
system.  The  method  was  chosen  because  of  lack  of  detail  in 
the  description  of  the  two  systems  and  the  means  of  developing 
them. 


3. 3. 1.1  RDT&E.  This  cost  category  includes  all  the  cost  for 
research,  engineering,  design,  analysis,  development  and 
testing  related  to  the  total  system.  Normally,  these  costs 
occur  during  the  Advanced  Development  and  Engineering  Develop¬ 
ment  Phase  of  R&D.  For  purposes  of  this  analysis,  it  was 
assumed  that  both  control  systems  would  be  through  this  phase 
of  development  before  they  were  considered  for  incorporation 
into  an  Advanced  Scout  Helicopter. 

3. 3. 1.2  Nonrecurring  Initial  Investment.  This  category  in¬ 
cludes  all  nonrecurring  engineering  design,  tooling,  produc¬ 
tion  engineering,  vendor  development  and  qualification,  and 
flight  test.  Only  the  costs  directly  associated  with  the 
flight  control  systems  were  included  in  this  figure.  Esti¬ 
mates  were  made  by  BHT  pricing  personnel  and  pricing  personnel 
from  the  various  vendors.  The  estimates  are  considered  to  be 
the  best  available  for  the  level  of  engineering  description  at 
this  time. 

Each  cost  estimate  was  derived  by  describing  the  subtasks 
required  and  submitting  them  to  the  responsible  groups  for 
manpower  and  material  estimates.  These  estimates  were  then 
priced  in  constant  FY  1979  dollars.  Comparisons  to  previous 
and  existing  programs  were  used  to  add  greater  validity  to  the 
estimates.  Table  12  shows  the  different  elements  of  the 
nonrecurring  initial  investment  cost  for  the  fly-by-wire  and 
the  dual  mechanical  control  systems.  The  dual  mechanical  is 
26  percent  more  costly. 

3. 3. 1.3  Recurring  Initial  Investment.  The  recurring  initial 
investment  is  divided  into  systems'  parts  and  assembly  cost. 
Table  13  shows  the  systems'  parts  cost  for  the  major  subsys¬ 
tems  for  each  flight  control  system.  A  total  buy  of  1450 
units  was  assumed.  Actual  quotes  were  obtained  from  vendors 
for  the  major  items  and  BHT  estimates  were  used  for  BHT  pro¬ 
duced  items  and  smaller  vendor  items. 

Table  13  combines  the  systems'  parts  and  assembly  cost  for 
total  recurring  initial  investment  cost.  The  FBW  system 
shows  a  12-percent  advantage  in  this  category. 


88 


TABLE  12.  NONRECURRING  INITIAL  INVESTMENT  COST 


Cost  category 

FBW 

Dual  mech 

Nonrecurring  Engineering  Design 

$3,964,225 

$3,639,157 

Nonrecurring  Tooling  and  Pro¬ 
duction  Engineering 

130,064 

3,415,580 

Nonrecurring  Vendor  Develop¬ 
ment  and  Qualification 

1,897,848 

1,095,646 

Flight  Test 

489,143 

286,735 

Total  Nonrecurring  Initial 
Investment 

$6,481,280 

$8,150,383 

TABLE  13.  RECURRING  INITIAL  INVESTMENT 

COST 

Cost  category 

FBW 

Dual  mech 

System  Parts  Cost* 

$199,947 

$219,970 

Assembly  Cost 

3,148 

6,952 

Total  Recurring  Initial 
Investment  per  Aircraft 

$203,095 

$226,922 

*Based  on  1450  Units 

3. 3. 1.4  Operations  and  Maintenance  (O&M).  The  O&M  costs  that 
were  identified  as  major  cost  contributors  that  would  have 
significant  differences  are  corrective  maintenance  labor  cost 
and  corrective  maintenance  parts  cost.  The  organizational  and 
intermediate  maintenance  man-hours  per  flight  hour,  as  shown 
in  Section  3.6,  were  used  to  determine  labor  costs  shown  in 
Table  14.  The  FBW  system  shows  a  68-percent  advantage  in  this 
area.  The  parts  consumption  was  determined  using  the  mean- 
time-between-failures  ( MTBF )  values  found  in  Section  3.5.  The 
parts  costs  are  shown  in  Table  15.  The  FBW  system  has  a  total 
O&M  advantage  of  35  percent. 
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TABLE  14.  CORRECTIVE  MAINTENANCE  COST 
(DOLLARS  PER  FLIGHT  HOUR)* 


Subsystem 

FBW 

Dual 

mech 

Labor 

Parts 

Labor 

Parts 

Stick,  Cranks  and  Linkages 

1.82 

1.66 

5.39 

2.46 

Hydraulic  Actuators 

1.50 

9.45 

2.59 

14.73 

Electromechanical 

Actuators 

0.07 

0.19 

0.28 

0.57 

Hydraulics  System 

0.58 

2.78 

1.40 

3.38 

Electrical  Supplies 

3.94 

6.86 

3.85 

6.75 

Sensors  and  Signal 

Processors 

0.12 

4.11 

0.28 

2.95 

Subtotal 

$  8.03 

$25.05 

$13.79 

$30.81 

Total  Parts  and  Labor 

$33. 

.08 

$44 

.60 

*Based  on  40  flight  hours  per  month  for  20 

years 

TABLE  15. 

SYSTEM 

PARTS  COST* 

Subsystem 

FBW 

Dual  mech 

Sticks,  Cranks  and  Linkages 

$  23,616 

$  43,143 

Hydraulic  Actuators/Packages 

68,852 

66,564 

Electromechanical  Actuators 

9,903 

25,204 

Hydraulic  Systems 

26,162 

24,076 

Electrical  Supplies 

5,187 

4,031 

Sensors  and  Signal  Processors 

66,227 

56,952 

Total 

$199,947 

$219,970 

*Based  on  1450  units 
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3. 3. 1.5  Life-Cycle  Cost  Comparison.  The  total  program  life- 
cycle  cost  for  each  system  is  shown  in  Table  16.  These  fig¬ 
ures  are  qualified  by  the  notes  shown  at  the  bottom  of  the 
table  and  by  the  fact  that  all  cost  categories  were  not  in¬ 
cluded  in  the  analysis.  The  total  program  life-cycle  cost 
advantage  of  the  FBW  system  is  $196  million  in  constant  FY 
1979  dollars. 


TABLE  16.  FLIGHT  CONTROL  LIFE-CYCLE  COST 
(TOTAL  PROGRAM) 


Cost  category _ FBW _ Dual  mech 


RDT&E* 


0 


0 


Nonrecurring  Initial 

Investment  6,481,280 


Recurring  Initial 

Investment**  294,690,845 

Corrective  Maintenance***  460,477,012 


8,150,383 

329,036,900 

620,832,000 


$761,649,137 


$958,019,283 


*See  Section  3. 3. 1.1 
**Based  on  1450  units 

***Based  on  40  flight  hours  per  month  for  20  years 


Dollar  inflation  will  alter  and  magnify  this  differential  cost 
over  the  life  of  the  program.  Assuming  fleot  service  initia¬ 
tion  in  1983  and  an  inflation  rate,  for  example,  of  10  percent 
per  annum,  then  the  total  program  life-cycle  cost  advantage  of 
the  FBW  system  increases  to  $810  million. 

3 . 4  POWER  SUPPLY  REQUIREMENTS 

In  order  to  provide  continued  operational  capability  after 
various  possible  system  failures,  redundancy  must  be  provided 
not  only  in  the  signal  transmission  paths,  but  also  iii  the 
electrical  and  hydraulic  power  supplies.  For  two- fail -operate 
capability,  a  FBW/L  system  must  have  at  least  three  separate 
electrical  and  three  separate  hydraulic  supplies. 
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The  command  augmentation  system  must  function  in  order  to  com- 
plete  the  ASH  mission.  This  requires  that  the  electrical 
supply  for  the  dual  mechanical  control  system  to  be  at  least 
fail-operate.  This  is  accomplished  by  the  use  of  two  AC  gener¬ 
ators  and  transformer  rectifiers  coupled  through  automatic 
switchover  circuitry.  For  the  FBW/L  system,  the  electrical 
power  supply  is  expanded  to  include  five  dedicated  alternators 
to  power  the  STAR  main  rotor  control  system.  This  electrical 
supply  configuration  is  depicted  in  Figure  20. 

Since  the  helicopter  is  uncontrollable  without  hydraulic 
pressure,  redundancy  of  hydraulic  pumps  is  provided.  The  dual 
mechanical  mechanization  utilizes  two  independent  hydraulic 
systems,  with  an  electrically  powered  auxiliary  system.  These 
are  discussed  in  Section  2.1.1.  One  system  is  used  to  pres¬ 
surize  one  of  the  two  pistons  of  each  dual  boost  actuator;  the 
other  system  is  used  to  pressurize  the  otner  piston.  If  both 
systems  fail  simultaneously,  the  auxijiar^  system  is  hydrau¬ 
lically  switched  to  provide  pressure.  Of  concern,  however,  is 
the  possibility  that  the  switchover  logic  may  itself  fail  and 
result  in  a  "domino"  failure  effect. 

The  FBW/L  control  system  considered  in  this  study  provides  a 
unique  approach  toward  the  hydraulic  supply  redundancy.  The 
system  utilizes  electromechanical  actuation  for  horizontal 
stabilizer  and  tail  rotor  control;  thus,  no  hydraulics  are 
needed  there.  However,  hydraulic  actuation  is  utilized  for 
main  rotor  control.  The  main  rotor  STAR  control  utilizes  five 
IAPs,  five  small  dedicated  hydraulic  pumps,  and  one  electri¬ 
cally  driven  auxiliary  hydraulic  pump  that  is  used  only  for 
fill-and-bleed  procedures  and  for  ground  check  of  the  FBW/L 
system  without  the  engine  running.  With  this  arrangement,  no 
hydraulic  switchover  is  necessary  in  the  redundancy  management 
concept. 

Components  of  the  dual  mechanical  and  FBW/L  system  are  tabu¬ 
lated  in  Table  17. 

3.5  RELIABILITY 

3.5.1  Methodology  and  Definitions 

3. 5. 1.1  Methodology.  An  analysis  was  performed  to  compare 
a  dual  mechanical  flight  control  system  to  the  BHT  proposed 
ASH  FBW  configuration  and  to  customer-supplied  goals.  The 
analysis  was  made  to  determine  whether  the  ASH.  Helicopter 
system,  mission,  or  flight  safety  reliability  would  be  im¬ 
proved  or  degraded  as  a  result  of  using  a  FBW  configuration 
rather  than  a  conventional  dual  mechanical  configuration. 
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TABLE  17.  POWER  SUPPLY  CONFIGURATION 


Dual  mechanical 

Fly-By-Wire/Light 

2ty 

AC  Generator/Controller 

(2) 

AC  Generator/Controller 

(2) 

Trans  f ormer/Rec ti f ier s 

(2) 

Trans  f ormer/Recti f iers 

(2) 

Battery 

(1) 

Battery 

(1) 

Switchover  Circuitry 

Alternator,  IAP  Dedicated 

(5) 

for  Elevator  and  Command 
Augmentation 

Switchover  Circuitry 
Elevator,  Tail  Rotor, 

Hydraulic  Pump/Cooler 

(2) 

and  Command  Augmenta¬ 
tion 

Auxiliary  Pump, 
Electrically  Driven 

(1) 

Dedicated  Hydraulic  Pump 

(5) 

Accumulators 

(3) 

Auxiliary  Pump, 

Electrically  Driven 

(1) 

The  reliability  analysis 

covers 

the  following: 

-  An  estimate  of  the  system  reliability 

System  .reliability 

50  percent  of  the  system  reliability 
200  percent  of  the  system  reliability 

-  An  estimate  of  the  mission  reliability 

Mission  reliability 

50  percent  of  the  mission  reliability 

200  percent  of  the  mission  reliability 

-  An  estimate  of  the  flight  safety  reliability 

Flight  safety  reliability 

50  percent  of  the  flight  safety  reliability 

200  percent  of  the  flight  safety  reliability 
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The  data  sources  used  for  the  analysis  were: 

-  Navy  Maintenance  and  Material  Management  (3-M)  data  for 
Models  UH-1N  and  AH-1J 

-  U.S.  Air  Force  AFM  66-1  data  for  Model  UH-1N 

-  BHT  field  service  reports  for  Models  214A  and  222 

-  U.S.  Army  Safety  Center  (USASC)  for  Model  UH-lH 

-  MIL-HDBK-217B,  Section  3 

3. 5. 1.2  Definitions .  The  following  definitions  were  used 
to  perform  the  analysis. 

-  Failure  -  The  inability  of  an  item  to  perform  within 
its  specified  limits.  For  those  items  subject  to 
progressive  deterioration  (i.e.,  corrosion,  leaks), 

a  failure  will  be  considered  to  have  occurred  when 
the  condition: 

Creates  a  flight  hazard 

Can  reasonably  be  expected  to  abort  a  mission 

Will  require  repair  or  replacement  before  flying 

another  mission 

-  Inherent  Failure  -  A  failure  caused  by  a  physical  con¬ 
dition  or  phenomenon  internal  to  the  failed  item. 

-  Independent  Failures  -  Those  failures  that  occur  or 
can  occur  without  being  related  to  the  malfunction¬ 
ing  of  associated  items. 

-  Time  (for  reliability  values  in  the  analysis)  -  flight 
hours  measured  from  aircraft  lift-off  until  aircraft 
touchdown . 

-  Mean-Time-Between-Failures  (MTBF)  -  The  average  opera¬ 
tional  flight  hours  between  independent  failures. 

-  Mission  -  A  time  period  measured  from  aircraft  lift¬ 
off  until  aircraft  touchdown.  A  mission  starts  only 
after  preflight  checkout  has  been  completed  and  the 
system  is  determined  to  be  operationally  ready. 


-  System  Reliability  -  The  probability  that  an  opera¬ 
tionally  ready,  mission-configured  system  of  the 
aircraft  will  complete  a  one-hour  mission  without 

a  failure  that  would  require  corrective  maintenance. 

-  Mission  Reliability  -  The  probability  that  an  opera¬ 
tionally  ready,  mission-configured  system  of  the 
aircraft  will  perform  all  mission-necessary  functions 
successfully  during  a  one-hour  mission. 

-  Flight  Safety  Reliability  -  The  probability  that  an 
operationally  ready,  mission-configured  system  of 
the  aircraft  will  operate  for  a  one-hour  mission 
without  the  occurrence  of  an  in-flight  failure  that 
would  result  in  injury  to  the  crew  (that  would  pre¬ 
clude  them  from  performing  their  mission  task)  or 
which  would  prevent  performance  of  a  controlled  land¬ 
ing. 

3.5.2  Reliability  Goals 

The  specified  reliability  goals  for  the  flight  control 
system  (including  electrical  and  hydraulic  power  supplies) 
are  defined  below.  The  goals  assume  a  constant  hazard 
function  and  a  mature  system. 

-  System  failure  (A  )  goal  of  one  failure  per  2500  hours 
of  operation 

As  =  1/MTBF 

=  1/2500  hours 

=  0.000400  failure  per  flight  hour 

-  Mission  failure  (Am)  goal  of  one  failure  per  10,000 
hours  of  operation 

Am  =  1/MTBF 

=  1/10,000  hours 

=  .000100  failure  per  flight  hour 

-  Flight  safety  (A  )  failure  goal  of  one  failure  per 
10,000,000  hours  of  operation 

Ac  =  1/MTBF 

=  1/10,000,000  hours 
=  .0000001  failure  per  flight  hour 
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3.5.3  Analysis 

3. 5. 3.1  System  Reliability  Failure  Rates.  The  system 
failure  rate  analysis  was  performed  using  the  inherent  fail¬ 
ure  rates  from  the  data  sources  of  Paragraph  3. 5. 1.1.  A 
failure  rate  was  predicted  for  each  component  in  the  flight 
controls,  electrical,  and  hydraulic  systems.  The  failure 
rates  were  based  on  the  historical  data  of  the  same  compo¬ 
nent  'or  a  similar  component  from  one  of  the  data  sources. 
These  data  were  used  to  obtain  the  system  failure  rates  and, 
with  modification,  the  50-  and  the  200-percent  system  failure 
rates . 

The  system  block  diagrams  shown  in  Figures  31  and  32  were 
used  in  the  analysis  procedure.  Figure  31  is  the  dual  me¬ 
chanical  system  block  diagram.  Figure  32  is  the  FBW  system 
block  diagram.  Since  the  failure  of  any  component  will 
create  unscheduled  maintenance,  the  various  components  are 
considered  (for  system  reliability  purposes)  to  be  in  series 
and  independent.  The  failure  rate  of  the  system  Ag  was 

thus  computed  as: 


„ 

^  i=l 


Ai 


(1) 


where , 

=  failure  rate  (failures  per  flight  hour)  of  each 
ith  system  element 

n  =  number  of  elements  in  the  system 


The  results  of  the  system  reliability  analysis  are  shown  in 
Tables  18  and  19.  Table  18  presents  the  mechanical  sys¬ 
tem  and  the  FBW  system  predicted  reliability  for  each  major 
system/component  grouping  and  the  allocated  system  relia¬ 
bility  goal  for  the  total  flight  control  system.  Table  19 
presents  the  system  failure  rates  for  each  component  of  the 
mechanical  system  and  the  FBW  system.  The  dual  mechanical 
flight  control  system  has  a  predicted  system  failure  rate 
of  0.039759  failure  per  flight  hour.  The  FBW  flight  con¬ 
trol  system  has  a  predicted  system  failure  rate  of  0.030914 
failure  per  flight  hour.  The  FBW  MTBF  is  thus  better  than 
the  mechanical  MTBF  by  28  percent.  Both  systems  are,  how¬ 
ever,  worse  than  the  specified  goal  by  about  two  orders  of 
magnitude . 


The  results  of  the  system  reliability  analysis  using  50  percent 
component  failure  rate  values  are  shown  in  Table  20.  The  table 
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Figure  31.  Dual  mechanical  system  reliability  block  diagram. 
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Figure  31.  Dual  mechanical  system  reliability  block  diagram. 
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Figure  32.  Fly-by-wire/light  system  reliability  block  diagram. 
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TABLE  19.  ASH  HELICOPTER  CONTROL  SYSTEM/COMPONENT  SYSTEM  -  FAILURE  RATES 


d  cm 

CM 


I  d  h- 
!>i  H 
XI  -H  vo 


o 

o 

o 

m 

r~ 

o 

o 

in 

vo 

in 

VO 

o 

in 

VO 

M 

CO 

in 

00 

in  1 

i 

1  vo 

m  i 

i  n 

n  i 

l  vo 

00 

m 

* — l 

m 

in 

H 

H 

ch  i — i  i — )  i — i  n  t  m 


Ml  I  I  M  I 


l  I  i  in  H 


Q  d  CM 


o 

o 

o 

in 

in 

o 

o 

in 

in 

m 

in 

M 

■<* 

M 

M 

•vr 

m 

VO 

o 

in 

vo 

ro 

ID 

in 

00 

in 

vo 

VO 

vo 

vo 

CO 

o\ 

cn 

a\ 

OI 

M 

ro 

00 

oo 

oo 

t — 1 

00 

in 

H 

CTV 

M 

M  H  H  M  vo  I 


MHMMM'tfCOo 

H 


VO  I  VO  ■'*  VO  M 
rH 


(U 

<c 

P 

p 

G) 

> 

X 

d 

X 

*H 

fp 

PI 

P 

•P 

■p 

Q) 

£ 

0 

* 

P 

0 

u 

X 

G) 

<U 

<u 

X 

d 

•p 

•H 

■P 

Pi 

> 

> 

rH 

CP 

PI 

rH 

H 

£ 

•H 

•H 

rH 

u 

0 

P 

■u 

■P 

0 

0) 

a) 

0) 

>i 

>1 

P 

a) 

u 

0 

u 

> 

0 

•p 

•p 

u 

0 

Oi 

0i 

0 

in 

> 

a) 

<u 

0) 

•H 

•p 

rH 

rH 

■p 

Ml 

<9 

Mi 

CM 

0) 

•P 

H 

rH 

i 

> 

■p 

X 

H 

0 

u 

i 

1 

d 

CM 

X 

CM 

CM 

w 

d 

4J 

H 

rH 

•H 

0 

(P 

0 

>i 

>i 

Pi 

[p 

O 

d 

U 

0 

0 

•p 

P 

a) 

0 

>1 

u 

a 

•p 

p 

Oi 

■H 

Oi 

10 

Ml 

(U 

0 

u 

p 

0 

i — 1 

•H 

0) 

u 

p 

p 

v> 

d 

0 

rH 

d 

d 

H 

0 

<u 

rH 

H 

•H 

i 

i 

0 

0 

•p 

•«H 

•rH 

0 

•p 

0) 

•H 

H 

1 

i 

CM 

rH 

0 

o 

H 

1 

CM 

CM 

rH 

p 

rH 

>i 

p 

> 

PI 

0 

CM 

rH 

u 

>i 

U 

■p 

■p 

CM 

CM 

u 

CM 

0 

0 

CM 

•p 

X 

u 

>1 

■p 

d 

0 

u 

>1 

p 

p 

p 

d 

d 

CO 

>i 

CO 

p 

in 

in 

d 

co 

u 

in 

0 

d 

0 

0 

10 

CO 

0 

0 

in 

Q 

Ml 

1 

in 

a) 

d 

1 

0) 

CM 

CM 

<U 

d 

a) 

a 

kiJ 

•P 

p> 

1 

0 

1 

*H 

CM 

CM 

pj 

Pi 

i 

rO 

i 

0 

V 

*« 

d 

>1 

dJ 

Ml 

01 

>1 

d 

•P 

a) 

•H 

in 

Ml 

>i 

u 

in 

■P 

ftJ 

>1 

d 

in 

P 

d 

CO 

CO 

Ml 

>i 

P 

>i 

d 

p 

Ml 

d 

in 

o 

in 

M-l 

P 

d 

in 

d 

in 

MM 

p 

d 

d 

in 

P 

m 

d 

p 

d 

•H 

in 

X 

< 

d 

0 

d 

in 

rH 

rtj 

d 

0 

us 

PI 

d 

d 

in 

0) 

in 

rH 

0) 

d 

PI 

< 

w 

xl 

p 

< 

rH 

XI 

P 

P 

«l 

> 

< 

rH 

> 

P 

Ml 

X 

in 

0) 

a 

a) 

Ml 

in 

0) 

p 

p 

u 

0 

o 

0) 

o 

0 

p 

P 

u 

u 

Ml 

U 

rH 

0) 

o 

U 

Ml 

u 

a) 

11) 

rH 

rH 

0) 

<u 

O 

H 

a) 

G> 

•H 

•H 

0 

P 

rH 

in 

•P 

u 

p 

> 

H 

H 

H 

P 

g 

X! 

in 

g 

H 

><1 

X 

■P 

V 

d 

0 

aj 

3 

•H 

P 

d 

0 

GJ 

dS 

G) 

a) 

3 

13 

3 

•p 

(3 

oi 

■p 

■P 

CO 

in 

b 

ti 

m 

EH 

g 

CO 

to 

CP 

PI 

H 

CQ 

CQ 

EH 

>-3 

EH 

g 

i-j 

Ol 

£ 

s 

102 


TABLE  19 .  (Continued) 
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(Single  Passive)  -  3  20 

Subtotal  3,350  5,428 

Total _ 39,759 _ 30  ,914 


TABLE  20.  ASH  HELICOPTER  CONTROL  SYSTEM/50  PERCENT  SYSTEM  -  FAILURE  RATE 
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presents  the  mechanical  system  and  FBW  system  predicted  relia¬ 
bility  for  each  major  system/component  grouping  and  the 
allocated  system  reliability  goal.  From  this  analysis,  the 
dual  mechanical  system  has  a  failure  rate  of  0.019879  failure 
per  flight  hour.  The  FBW  system  has  a  failure  rate  of  0.015457 
failure  per  flight  hour.  Similarly,  the  FBW  MTBF  is  better 
than  the  dual  mechanical  MTBF  by  29  percent.  Both  systems  at 
50  percent  failure  rate  levels  are  still  worse  than  the  speci¬ 
fied  system  reliability  goal. 

The  results  of  the  system  reliability  analysis  using  200 
percent  component  failure  rate  values  are  shown  in  Table  21. 

The  table  presents  the  mechanical  system  and  FBW  system  pre¬ 
dicted  reliability  for  each  major  system/component  grouping 
and  the  allocated  system  reliability  gcal.  From  this  analy¬ 
sis,  the  dual  mechanical  system  has  a  failure  rate  of  0.079518 
failure  per  flight  hour.  The  FBW  system  has  a  failure  rate 
of  0.061828  failure  per  flight  hour.  The  FBW  MTBF  is  still 
better  than  the  mechanical  system,  but  worse  than  the  speci¬ 
fied  system  reliability  goal. 

3. 5. 3. 2  Mission  Reliability  Failure  Rates.  The  mission 
analysis  was  performed  using  the  data  sources  of  Paragraph 
3. 5. 1.1.  A  limited  failure  modes  and  effects  analysis  was 
performed  for  each  of  the  components  of  the  flight  controls, 
the  electrical  system,  and  the  hydraulic  system  to  obtain  the 
mission  failure  rates.  The  components  were  analyzed  to  deter¬ 
mine  which  type  of  failure  modes  would  cause  a  loss  of  a 
function  that  would  affect  the  mission  and  thereby  cause  a 
mission  abort.  For  mission  consideration,  control  of  the  main 
rotor,  tail  rotor,  and  command  augmentation  is  required.  This 
defines  the  following  mission  critical  functions  for  the  con¬ 
trol  system: 

-  Sticks,  pedals,  and  mechanical  linkages/mixers 

-  Main  rotor  and  tail  rotor  boost  actuators 

-  Hydraulic  system 

-  Electrical  system  to  power  command  augmentation 

-  Command  augmentation  sensors/electromechanical  actuators/ 
computers 

Tables  22  and  23  provide  a  summary  of  failure  rates  for 
various  items  depicted  in  Figures  31  and  32,  respectively. 
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TABLE  21.  ASH  HELICOPTER  CONTROL  SYSTEM/200  PERCENT  SYSTEM  -  FAILURE  RATE  SUMMARY 
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TABLE  22.  DUAL  MECHANICAL  CONTROL  SYSTEM 
FAILURE  RATES  X  10"6 


Item 

Description 

Mission 

Rate 

Flight 

Safety 

9 

Tail  Rotor  Boost  Servo 

269 

- 

10 

Skewed  Sensor  Ins 

200 

- 

11 

Dual  Air  Data  Sensors 

25 

- 

12 

Forward  MRTU 

280 

- 

13 

Aft  MRTU 

380 

- 

14 

SAS  Pitch  Servo 

82 

- 

15 

SAS  Roll  Servo 

82 

- 

16 

SAS  Collective  Servo 

82 

- 

17 

Mech  Links,  Mixer 

1912 

0.474 

18 

Fore/Aft  1  Boost  Servo 

269 

0.237 

19 

Fore/Aft  2  Boost  Servo 

269 

0.237 

20 

Lateral  Boost  Servo 

269 

0.237 

21 

Elec  Power 

1294 

259.0 

22 

Hydraulic  Supply 

1775 

355.0 

23 

Electrically  Driven  Pump  Supply 

1400 

280.0 

24 

Tail  Rotor  Associated  Mechanical 
Linkage 

793 

- 

25 


Dual  Position  Sensors 


10 


TABLE  23.  FLY-BY-WIRE  CONTROL  SYSTEM 


FAILURE  RATES  X  10 


Item 

Description 

Mission 

Rate 

Flight 

Safety 

10 

Skewed  Sensor  Ins 

200 

- 

11 

Dual  Air  Data  Sensors 

25 

- 

12 

Forward  MRTU 

280 

- 

13 

Aft  MRTU 

380 

- 

21 

Electrical  Power  (non-dedicated) 

1294 

- 

24 

STAR  System* 

8.29 

0.0071 

25 

Tail  Rotor  Electronic  Servos 

679 

0.038 

26 

Mechanical  Linkage  from  Cockpit 
Controls  to  Motion  Transducers 

1553 

*  See  Section  4.3.2 


The  mission  failure  probability  for  the  dual  mechanical  system 
may  be  expressed 

PM  =  Ag2  +  (A10  +  A11  +  A12  +  A25*2  +  A132  +  A142 

m  (2) 

+  \152  +  \162  +  \1?  +  \18  +  X19  +  \20  +  A2x2  +  A22 


+  X 


24 


Substituting  the  failure  rates  from  Table  22  yields 

PM  2  5287  x  10"6 
m 


(3) 


and 


Mission  MTBF 


10' 


(Dual  Mechanical)  =  5287 


=  189  hours 
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For  the  fly-by-wire  system,  the  mission  failure  probability 
may  be  expressed 

PM  -  A.M  +  Um  +  +  +  A.-, +  A.01^  +  3\oi-2  +  \ 

Mfbw  "star  10  11  12  13  21  25  {f’ 


Substituting  the  failure  rates  from  Table  23  yields 


■M 


=  11.74  x  10"6  +  X 


fbw 


26 


(5) 


where  A26  is  the  mission  failure  rate  estimated  for  the  cock¬ 
pit  sticks/pedals  and  associated  linkage  to  the  fly-by-wire 
control  motion  transducer.  Excluding  the  contribution  of 
\26,  the  fly-by-wire  mission  failure  MTBF  is 

•  ■  10^ 

Mission  MTBF(fbw  w.thout  ^  S  =  85,179  hours 

This  exceeds  the  mission  failure  goal  of  10,000  hours i 

However,  when  the  contribution  of  \26  is  included,  the  MTBF 
becomes  /b 


Mission  MTBF^fbwj  =  ^-555  =  640  hours 


A  significant  reduction  in  predicted  mission  MTBF  is  ob¬ 
tained  when  this  factor  is  considered t  This  results  from 
the  fact  that  the  conventional  cockpit  controls  utilized 
here  have,  by  nature,  a  number  of  possible  failure  anomalies. 

It  is  expected  that  human  factor  aspects  and  expedience  will 
enable  a  modification  of  the  typical  cockpit  in  the  future 
so  that  this  problem  is  substantially  improved. 

Fifty  percent  and  200  percent  component  failure  rates  may  be 
used  to  compute  additional  mission  reliability  numbers.  Re¬ 
sults  are  tabulated  in  Table  24.  In  all  cases,  the  fly-by-wire 
system  is  better  than  the  dual  mechanical. 


3. 5. 3. 3  Flight  Safety  Failure  Rates.  The  flight  safety 
analysis  was  performed  using  Sperry  Flight  System  data  or  MIL- 
HDBK-217B  for  the  electronic  components  and  USASC  accident 
data  for  the  UH-lH  helicopter  for  the  mechanical,  electrical, 
and  hydraulic  power  components.  The  USASC  data  were  examined 
to  see  what  type  of  failure  modes  have  caused  the  accidents  in 
the  past  and  to  see  if  the  modes  had  been  eliminated  by  design 
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TABLE  24.  ASH  HELICOPTER  CONTROL  SYSTEM  MISSION  FAILURE  SUMMARY 
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of  the  ASH  system.  Class  identifications  for  the  data  examined 
were : 

-  Total  loss 

-  Major 

-  Minor 

-  Incident 

-  Forced  landing 

Only  components  that  are  critical  to  the  flight  control  func¬ 
tion,  i.e.,  where  failure  results  in  loss  of  controlled  flight, 
were  considered  in  the  flight  safety  analysis. 

For  flight  safety,  control  of  the  main  rotor  is  required.  It 
is  assumed  that  loss  of  tail  rotor  control  or  command  augmen¬ 
tation  results  in  an  abort  of  the  mission  such  that  critical 
flight  conditions  are  avoided. 

For  the  dual  mechanical  control  system,  control  of  the  main 
rotor  boost  control  actuators  : c  required  for  flight  safety. 

Two  hydraulic  systems  and  a  third  electrically  powered  auxi¬ 
liary  system  are  available  for  hydraulic  power.  The  flight 
safety  failure  probability  may  be  written 


PC  "  X172  +  X182  +  X192  +  X202  +  X22  (X23  +  X2l^ 

m 

Substituting  the  flight  safety  failure  rates  from  Table  22 
yields 

Pr  =  3.57  x  10"11  (7) 

um 

with  the  50  and  200  percent  component  failure  rate  conditions 
yielding  4.52  x  10-'1'2  and  2.84  x  10"'*’0,  respectively. 

For  the  fly-by-wire  control  system,  control  of  the  main  rotor 
swashplate  by  the  fly-by-wire  implementation  must  be  assured 
for  flight  safety.  The  various  combinations  of  IAP  states 
under  which  control  is  maintained  are  discussed  in  Section  4. 
Except  for  the  single  mechanical  portion  of  the  control  system 
that  connects  the  cockpit  controls  to  the  fly-by-wire  control 
motion  transducers,  the  system  is  quintuplexed.  The  flight 
safety  failure  probability  may  be  written 


P 


C 


fbw 


+  A, 


STAR 
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(8) 


Using  the  flight  safety  failure  rates  from  Table  23,  the 
flight  safety  failure  probability  may  be  approximated  as 

Pp  2  4.51  x  10"8 
Lfbw 

The  contribution  to  flight  safety  failures  made  by  the  mechan¬ 
ical  linkage  to  the  control  motion  transducers  may  be  reduced 
to  insignificance  (compared  to  the  redundant  STAR  channels)  by 
using  advanced  cockpit  controls  (e.g.,  direct  connections  of 
transducers  to  side-arm  controller)  or  by  dualizing  the  link¬ 
age.  In  these  cases, 

Pp  (neglecting  A,a)  =  7.1  x  10"8  (9) 

Lfbw 

The  flight  safety  reliability  for  the  dual  mechanical  and  fly¬ 
by-wire  control  systems  are  summarized  in  Table  25.  In  all 
cases,  the  dual  mechanical  system  is  better  than  the  fly-by¬ 
wire  system. 

3.6  MAINTAINABILITY  AND  AVAILABILITY 

The  following  paragraphs  compare  the  maintainability  and 
availability  features  of  the  dual  mechanical  and  the  fly-by¬ 
wire/light  control  systems.  The  analysis  includes  the  entire 
system  from  the  cockpit  controls  to  the  main  rotor  and  tail 
rotor  control  systems. 

3.6.1  Methodology  and  Definitions 

The  following  assumptions  are  used  in  the  analysis: 

-  720  hours/month 

-  40  flight  hours/month  (FH/MO) 

-  1.3  flight  hours/flight 

-  1.8  flights/day  (average)  for  days  flown 

-  300  flight  hours/periodic  inspection 

-  Preflight  inspection  is  accomplished  prior  to  the  first 
flight  of  the  day.  Its  intended  purpose  is  to  assure 
that  nothing  has  occurred  during  the  prior  period  of 
unattended  idleness  that  could  jeopardize  safety  of 
flight  or  mission  accomplishment. 
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Model  UH-1N  3-M  data  are  used  as  the  basis  in  calculating 
corrective  maintenance  factors  such  as  mean-time-to-repair 
(MTTR) ,  elapsed  time  (ET)  per  task,  number  of  men  required  per 
task,  and  maintenance  man-hours  per  flight  hour  (MH/FH)  for 
the  MUT  dual  mechanical  system.  These  data  were  logged  during 
189,251  flight  hours  with  an  average  flight  time  of  1.3  hours. 
The  UH-1N  helicopter  is  used  for  a  baseline  because  the  flight 
control  system  closely  resembles  one  channel  of  the  MUT  dual 
mechanical  system  and  an  abundance  of  data  were  available. 

Calculations  of  fly-by-wire  (FBW)  corrective  maintenance  are 
based  on  comparisons  with  the  dual  mechanical  system  where 
similar  systems  exist  and  on  previous  in-house  FBW  reference 
studies  where  components  are  unique. 

The  tasks,  task  times,  and  the  number  of  men  to  rig  the  con¬ 
trol  system  of  the  Model  UH-1N  are  used  as  a  baseline  for 
rigging  the  MUT  dual  mechanical  system.  These  times  were 
factored  to  account  for  redundant  components.  The  rigging 
times  are  included  in  the  corrective  MMH/FH.  Rigging  times 
for  the  FBW  systems  are  estimated  based  on  tasks  defined  in 
previous  in-house  studies. 

Daily  and  periodic  inspection  requirements  for  the  Model  UH-lN 
are  used  as  a  basis  for  the  MUT  dual  mechanical  system. 
Inspection  times  are  factored  for  differences  in  complexities. 
The  factors  are  used  for  both  daily  and  periodic  inspections. 
Access  times  for  both  inspections  are  deleted  because  the 
daily  does  not  require  access,  and  periodic  requires  all 
accesses  to  be  opened  before  the  inspection  can  start.  FBW 
inspection  requirements  and  times  are  based  on  comparison  with 
the  dual  mechanical  system  with  factors  for  complexity  and 
from  results  of  other  in-house  studies. 

3.6.2  Corrective  Maintenance 

Corrective  maintenance  is  performed  on  a  nonscheduled  basis 
to  restore  equipment  to  satisfactory  condition  by  providing 
correction  of  a  malfunction  that  has  caused  degradation  of  the 
item  below  the  specified  performance. 

Organizational  and  intermediate  man-hours  per  flight  hour  for 
the  dual  mechanical  and  fly-by-wire/light  control  systems  have 
been  tabulated  and  are  compared  below. 
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3. 6.2.1  Dual  Mechanical  System 


MH/FH 


Organizational  level  0.318 

Intermediate  level  0.099 

0.417 


Rigging  (end-to-end)  except  elevator 

9.49  elapsed  hours  (EH)  Time  included  in 

17.86  MH/occurrence  organizational  level 

3. 6. 2. 2  Fly-By-Wire  System 


MH/FH 

Organizational  level  0.142 

Intermediate  level  0.096 

0.238 


Rigging  (end-to-end)  except  elevator 

2.4  elapsed  hours  Time  included  in 

3.63  MH/occurrence  organizational  level 

3.6.3  Preventive  Maintenance 


Preventive  maintenance  is  the  care  and  servicing  by  personnel 
for  the  purpose  of  maintaining  equipment  in  satisfactory 
condition  by  providing  for  systematic  inspection,  detection, 
and  correction  of  incipient  failures,  either  before  they 
occur,  or  before  they  develop  into  major  defects. 


Daily  inspection  is  one  that  is  performed  after  the  last 
flight  of  the  day,  or  prior  to  the  first  flight  on  the  next 
day  the  aircraft  is  flown.  By  previous  assumptions,  1.3 
flight  hours/flight  and  1.8  flights/day  yields  2.34  flight 
hours/day.  Thus,  we  have  an  inspection  frequency  of 

=  0,43  (inspection  frequency) 


Periodic  inspection  is  a  comprehensive  inspection  performed 
each  300  hours.  Thus,  we  have  an  inspection  frequency  of 


1 

300 


0.00333 
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Comparisons  of  the  preventive  maintenance  man-hours  per  flight 
hour  for  the  dual  mechanical  and  fly-by-wire/light  control 
systems  are  made  below. 

3. 6. 3.1  Dual  Mechanical  System 

Daily  inspection:  0.43  x  0.44  MH  =  0.189  MH/FH 

Periodic  inspection:  0.00333  x  3.8  MH  =  0.013  MH/FH 

3. 6. 3. 2  Fly-By-Wire  System 

Daily  inspection:  0.43  x  .22  MH  =  0.095  MH/FH 

Periodic  inspection:  0.00333  x  1.9  MH  =  0.006  MH/FH 

3.6.4  Availability 


The  effects  of  the  two  systems  on  the  availability  of  the 
helicopter  is  computed  from  the  system  failure  and  scheduled 
and  unscheduled  maintenance.  The  following  formula  is  used 

A  -  Calendar  Time  -  Downtime 
A  Calendar  Time 


where  downtime  is  any  time  the  helicopter  is  down  for  either 
scheduled  or  unscheduled  maintenance. 

In  the  following  paragraphs,  the  availability  of  the  dual  me¬ 
chanical  system  and  fly-by-wire/light  system  are  computed: 

3. 6. 4.1  Dual  Mechanical  System 

Corrective  (organizational  level)  .318  MH/FH 
1.97  men/task  (average) 

.318  MH/FH  r  1.97  men/task  =  .162  elapsed  time  ( MTTR ) 
.162  x  40  FH/MO  =  6.48  EH/Mo  (elapsed  hours/month) 

Preventive 

Daily:  .43  FH  (frequency)  x  .44  MH  =  .189  MH/FH 

1.0  man/task 

.189  MH/FH  r  1  man/task  =  .189  EH/FH 
.189  EH/FH  x  40  FH/Mo  =  7.56  EH/Mo 
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I  3 

l  : 


Periodic:  .00333  FH  (frequency)  x  3.8  MH  =  .013  MH/FH 

1.5  men/task  average 

.013  MH/FH  +  1.5  men/task  =  .008  EH/FH 

.008  EH/FH  X  40  FH/Mo  =  .320  EH/Mo 

6.48  EH/MO  +7.56  EH/Mo  +  .320  EH/Mo  =  14.36  EH/Mo 

A  =  720,7?n  36  =  percent  availability  for  the  flight 

^  control  system  (dual  MUT) 

3. 6. 4. 2  Fly-By-Wire  System 

Corrective  (organizational  level)  . 142  MH/FH 
1.97  men/task  (average) 

.142  MH/FH  +  1.97  men/task  =  .072  elapsed  time  (MTTR) 
.072  x  40  FH/Mo  =  2.88  EH/MO  (elapsed  hours/mo) 


Preventive 

Daily:  .43  FH  (frequency)  x  .22  MH  =  .095  MH/FH 

1.0  man/task 

.095  MH/FH  +  1  man/task  =  .095  EH/FH 
.095  EH/FH  x  40  FH/Mo  =  3.8  EH/Mo 

Periodic:  .00333  FH  (frequency)  x  1.9  =  .006  MH/FH 

1.5  men/task  average 

.006  MH/FH  +1.5  men/task  =  .004  EH/FH 

.004  EH/FH  x  40  FH/Mo  =  .160  EH/Mo 

2.88  EH/Mo  +3.8  EH/Mo  +  .160  EH/Mo  =6.84  EH/Mo 

A  =  - 2 a r 84  =  99.05  percent  availability  (for  the 

flight  control  system  -  ASH 
FBW) 

The  maintainability  and  availability  comparisons  may  be  summar 
ized  in  Table  26. 

3.7  PREDICTED  HANDLING  QUALITIES 

In  comparing  the  FBW/L  flight  control  system  with  the  dual  me¬ 
chanical  flight  control  system,  the  difference  results  primar¬ 
ily  from  the  added  capability  derived  from  the  more  sophisti¬ 
cated,  flexible  command  augmentation  system  implemented  in  the 
FBW/L  system.  The  unaugmented  FBW/L  control  system  is  simply 
a  replacement  for  the  conventional  push-pull  tube,  bellcrank, 


119 


TABLE  26.  MAINTAINABILITY  AND  AVAILABILITY  COMPARISON 


System 

Corrective 

Maintenance 

MH/FH 

Preventive 

Maintenance 

MH/FH 

Availability 

Org 

Int 

Daily 

Periodic 

Dual  Mechanical 

.  318 

.099 

.188 

.013 

98% 

Fly-by-Wire 

.142 

.096 

.096 

.006 

99% 

etc.  The  unaugmented  FBW/L  system  operates  in  a  similar  manner 
as  the  conventional  control  system.  The  conventional  system, 
however,  will  exhibit  some  control  free  play,  friction,  inertia, 
and/or  wind-up  that  will  prevent  the  pilot  from  having  as  re¬ 
sponsive  a  control  as  is  available  with  the  FBW/L  control  sys¬ 
tem.  This  limits  the  capability  of  the  command  augmentation 
function  of  the  conventional  mechanical  control  where  authority 
and  rate-limited  secondary  actuators  mechanically  sum  the  com¬ 
mand  augmentation  input  to  the  pilot's  input.  The  limitation 
results  basically  from  the  nonlinearities  and  mechanical  im¬ 
pedances  that  constrain  the  closed-loop  gains  and  compensation 
techniques  from  a  stability  and  response  standpoint.  In  the 
FBW/L  control  system,  high  gain  feedback  is  used  to  attenuate 
gust  responses,  and  good  model-following  characteristics  are 
determined  by  the  command  augmentation  signal  shaping. 

Another  area  of  comparison  between  the  dual  mechanical  and  the 
FBW/L  control  systems  is  in  the  area  of  control  mode  and 
adaptive  flight  capability.  In  the  case  where  the  control 
sticks  are  mechanically  connected  to  the  helicopter  swash- 
plate,  the  type  of  control  mode  is  fixed.  A  displacement  of 
the  stick  establishes  a  particular  position  of  the  swashplate. 

In  the  case  of  FBW/L  control,  on  the  other  hand,  the  control 
signal  derived  from  the  control  stick  (which  could  be  gener¬ 
ated  from  either  displacement  or  force)  may  be  electronically 
processed  to  provide  rate  and/or  displacement  of  the  swash- 
plate  and  may  be  scheduled  by  other  parameters,  such  as  air¬ 
speed,  altitude,  etc.  Great  flexibility  is  available  in  the 
FBW/L  control  law  implementation  so  that  the  pilot  may  con¬ 
centrate  his  effort  more  on  the  tactical  situation  and  less  on 


the  basic  flight  requirements.  This  is  of  significant  im¬ 
portance  during  such  diverse  tasks  as  nap-of-the-earth,  night 
flying,  precision  hover,  and  formation  flight. 

Typically,  in  hover  or  low-speed  flight,  the  pilot  must  control 
the  helicopter's  velocity  or  the  integral  of  velocity  (posi¬ 
tion).  However,  velocity  is  proportional  to  the  integral,  of 
attitude,  which  is  the  integral  of  attitude  rate.  Most  basic 
aircraft  present  essentially  an  attitude  rate  response  to  a 
control  input.  Therefore,  the  pilot  must  mentally  perform 
three  integrations  in  order  to  control  position.  Studies  of 
pilot  performance  in  a  compensatory  task  have  indicated  that, 
ideally,  the  pilot  should  be  represented  as  a  first-order  lag 
of  about  one  second  and  a  transport  delay  of  about  one-half 
second.  Thus,  the  pilot  should  not  be  expected  to  provide  any 
lead. 

An  ideal  system  to  reduce  the  pilot's  hovering  work  load  is 
one  that  provides  a  velocity  response  to  a  control  input. 

This  has  been  provided  in  the  FBW/L  control  system  using 
accelerometers  to  derive  velocity  signals.  This  velocity 
maneuvering  system  relieves  the  pilot  of  180  degrees  of  lead 
or  anticipation  required,  thus  significantly  reducing  his  work 
load. 
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4 .  REDUNDANCY  MANAGEMENT 


Redundancy  management  techniques  recommended  for  the  FBW/L 
flight  control  system  are  those  that  provide  the  capability 
for  continuous  flight  control  even  after  certain  failures  have 
occurred. 

4.1  REDUNDANCY  PHILOSOPHY 

Deciding  upon  a  level  of  redundancy  for  the  various  systems, 
subsystems,  circuits,  and  assemblies  requires  the  trade-off  of 
two  opposing  considerations.  On  one  hand,  the  simple  systems 
have  fewer  parts,  lower  cost,  and  typically  lower  weight. 

These  systems  may  have  unacceptable  flight  safety  reliability. 
On  the  other  hand,  more  complex  systems  that  have  the  multi¬ 
plicity  of  subsystems,  circuits,  and  assemblies,  in  order  to 
meet  the  flight  safety  reliability,  may  have  an  unacceptable 
unscheduled  maintenance  reliability  and  may  be  too  costly  and 
too  heavy.  Thus,  some  compromise  may  be  required.  However, 
since  loss  of  life  is  considered  unacceptable,  the  flight 
safety  reliability  tends  to  predominate  the  philosophy  of 
design  typically  with  the  result  of  an  undesirably  high 
unscheduled  maintenance  (system)  failure  rate. 

Reference  7  considered  three  different  approaches  to  fly-by¬ 
wire  implementation  on  the  main  rotor.  The  first  approach 
utilizes  a  quad-redundant  electronic  channel  in  each  of  the 
three  control  axes  (roll,  pitch,  and  collective)  and  controls 
a  triple-piston  actuator  and  electronic  actuator  model.  The 
second  approach  uses  a  dual  piston  actuator  on  each  of  the 
three  axes  with  each  piston  section  controlled  by  dual  elec¬ 
tronics  and  electrohydraulic  servo  valves.  The  third  ap¬ 
proach  utilizes  a  five-arm  swashplate  concept  described  pre¬ 
viously.  The  last  system  was  selected  as  the  least  complex, 
the  most  reliable,  and  the  lightest. 

A  detailed  FBW  actuation  study  is  presently  underway  at  BHT 
under  NASA  Ames  contract  entitled  "A  Study  of  the  Reliability 
of  Present  and  Proposed  Helicopter  and  Aircraft  Actuation  Sys¬ 
tems  . "  This  study  is  considering  the  following  schemes : 

-  Secondary  electrohydraulic  actuators. 

-  Primary  hydraulic  actuators. 

-  All-electric  actuators. 


7Carlock,  G.,  and  Guinn,  K.,  STATUS  REPORT  OF  FLY-BY-WIRE  RE¬ 
SEARCH  PROJECT  FOR  1978  FLIGHT  EVALUATION  SYSTEM,  Bell  Heli¬ 
copter  Textron  Report  599-303-001,  December  1976. 
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-  Vibration  control  through  actuators. 

-  Control  for  helicopters  without  swashplates. 

The  particular  system  configurations  for  both  the  dual  mechani¬ 
cal  control  system  and  the  FEW/L  control  system  were  presented 
in  Section  2.  The  corresponding  reliability  and  maintainabil¬ 
ity  features  were  then  compared  in  Section  3 . 

4.2  DUAL  MECHANICAL  CONTROL  SYSTEM 

The  dual  mechanical  control  system  includes  dual  boost  servos 
for  pitch,  roll,  collective,  and  tail  rotor  control  functions, 
the  use  of  two  hydraulic  systems,  plus  a  utility  backup  and 
two  electric  power  supplies . 

The  dual  boost  actuator  design  utilizes  spring  cartridges  at 
the  input  of  the  mechanical  actuator  valves  so  that  if  one 
side  of  the  dual  mechanical  system  was  to  become  jammed,  the 
other  side  could  still  valve  the  actuator.  The  boost  actuator 
itself  is  designed  so  that,  in  theory,  either  of  the  two 
pistons  may  break  a  jam  of  the  other.  This  requires  that  the 
break-free  force  of  a  jam  be  less  than  the  design  load  capa¬ 
bility  of  either  side  of  the  dual  actuator. 

The  hydraulic  and  electrical  supplies  are  configured  so  that 
automatic  switchover  from  one  supply  to  another  is  achieved 
after  the  first  failure.  In  the  case  of  the  hydraulic  supplies, 
a  third  supply,  the  utility,  may  provide  hydraulic  pressure 
after  the  second  main  hydraulic  system  failure.  Of  concern, 
however,  is  the  possibility  that  the  switchover  logic  may 
itself  fail  and  result  in  a  "domino"  failure  effect  as  the 
other  systems  are  switched. 

4.3  FLY-BY-WIRE/LIGHT  CONTROL  SYSTEM 

The  fly-by-wire/light  control  system  utilises  the  same  hori¬ 
zontal  stabilizer  control  system  that  is  configured  for  the 
dual  mechanical  system  (originally  specified  on  the  MUT  as 
FBW) .  The  control  is  designed  to  be  dual  and  fail-safe,  and 
is  not  to  be  mission  or  flight  essential  for  the  ASII  mission. 

The  tail  rotor  control  is  considered  mission  essential  and  the 
main  rotor  control  is  considered  both  mission  and  flight 
essential. 

4,3.1  STAR  Channel  Status  Definition 

The  five  actuator  STAR  main  rotor  control  system  utilizes 
independent  control  paths  from  the  pilot's  input  (as  measured 
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by  a  passive  sensor)  to  the  output  of  the  IAP  (connected  to 
the  swashplate).  Each  channel  operates  independently  of  the 
other  channels  using  a  dedicated  hydraulic  pump  and  a  dedicated 
electrical  alternator.  Functionally,  each  channel  may  be 
represented  as  shown  in  Figure  33. 

The  helicopter  is  controlled  in  collective,  pitch,  and  roll  by 
the  position  of  the  swashplate;  thus,  loss  of  control  of  the 
swashplate  constitutes  a  failure  condition  of  the  STAR  control 
system.  Since  the  swashplate  is  positioned  by  redundant  lAPs, 
their  status  contributes  to  the  failure  modes. 

The  status  of  an  IAP  can  be  categorized  by  one  of  the  follow¬ 
ing  states:  normal,  bypassed,  nulled,  hardover,  or  hydrau¬ 
lically  locked.  Since  the  IAP  is  electronically  controlled 
and  monitored,  the  failure  of  the  associated  electronics, 
as  well  as  certain  failures  of  the  IAP  itself,  will  contri¬ 
bute  to  the  determination  of  the  IAP  status  at  any  particular 
time.  Functionally,  each  channel  has  a  power,  control,  moni¬ 
tor,  bypass,  pressure  check,  and  load-relief  characteristic. 

4. 3. 1.1  Function  Group  Failure  Model.  Figure  33  identifies 
the  functional  component  groupings  of  the  integrated  actuator 
package.  These  component  groups  are  labeled  A  through  H,  with 
three  states  defined  for  each  group.  The  first  state  in  each 
group  is  the  normal  state  and  the  other  two  are  failure  states. 
The  failure  state  and  failure  rate  of  each  group  are  listed 
in  Tables  27  and  28,  respectively. 

The  failure  model  used  to  establish  the  group  failure  rates  in 
Table  28  is  depicted  in  Figure  34.  Each  of  the  groups,  A 
.through  H,  has  an  identical  model  where  the  individual  com¬ 
ponents  together  establish  the  associated  failure  rates. 

Switches  and  S2  have  failure  rates  A-j  and  A2,  respectively, 

determined  by  reliability  analyses  of  the  functional  components. 

The  model  is  in  the  normal  state,  State  1,  when  switches  S-^ 
and  S2  are  open  (no  failures).  State  2  occurs  when  is 
closed  and  S2  is  open.  State  3  occurs  when  S2  is  closed. 

Mathematically,  the  probabilities  may  be  written 

-An  “(^1  ^  ^?) 

P[ State  1]  =  e  1  e  '  =  e  x  * 


P[ State  2]  =  (1-e  1)e  2 
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P[ State  3]  =  1-e 

Since  the  model  must  exist  in  one  of  the  above  states,  the 
mathematical  sum  of  the  three  probabilities  must  sum  to  unity. 
This  can  be  shown  to  be  the  case. 


«  i  ,  ,  , 

In  the  above  equations,  e  represents  a  reliability  ex¬ 
pression,  R^.  Correspondingly,  a  failure  expression  can  be 

written 


In  the  case  where  is  a  very  small  number,  the  above  mathe¬ 
matical  expressions  can  be  approximated: 


i-*i 


and 


2i 


h 


Thus,  the  probability  expressions  for  States  1,  2,  and  3  may 
be  approximated  as 

P[ State  1]  =  l-Aj-^ 

PIState  2]  *  A-l  (l-A.,)  =  ^  =  Astate  2 
P[ State  3]  s  X2  =  Astate  3 

4. 3. 1.2  IAP  State  Probabilities .  Using  the  faixure  models 
and  group  failure  rates  tabulated  above,  the  various  IAP  state 
conditions  and  state  probabilities  may  be  derived.  Using 
Boolean  algebra,  functional  group  states  may  be  aggregated 
into  logic  equations,  which  represent  the  various  states  of 
the  IAP. 
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Figure  33.  Functional  block  diagram  of  one  STAR  channel. 


TABLE  27.  FUNCTIONAL  GROUPINGS  OF  IAP  COMPONENTS 


TABLE  28.  JAP  GROUP  FAILURE  RATES 


Grcup/state 

Failure  rate  x  10  hours 

A2 

*A2  =  24.3 

A3 

*-A3  -  38.4 

B2 

}B2  =  4.7 

B3 

^B3  =  4.7  ! 

C2 

”C2  =  10.0 

C3 

*C3  =  20.4 

D2 

*D2  =  2.5 

D3 

*D3  =  5.6 

E2 

*E2  =  7.5 

E3 

^E3  =  9.6 

F2 

}F2  =  12.5 

F3 

J>F3  =16.7 

G2 

*G2  =  9.0 

G3 

^G3  =  14.8 

H2 

*-H2  =  32.0 

H3 

L 

*H3  =  0.5 
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One  of  the  failure  states  of  the  IAP  is  the  Bypass  state, 
which  occurs  when  one  or  more  of  the  following  conditions 
exist,  as  expressed  in  Boolean  algebra: 

(a2  +  a3  +  h3)  b1  c2  d2  e2  f2  g2 
^2  ^2  ^2  P2  ^2 


E3  C2  D,  F,  G2 


F„  C0  D0  G0 
o  2  2  2 


If  these  expressions  are  interpreted  as  events,  then  the 
probability  of  an  event  may  be  determined  from  the  functional 
group  failure  rates  by  substituting  probability  expressions 
from  the  failure  model  and  adding  the  "or"  terms  and  multi¬ 
plying  the  "and"  terms  of  the  Boolean  expression.  When  this 
is  performed,  the  following  expression  is  obtained: 


PBP  ~  AA2 


In  addition  to  these  IAP  group  failure  rates,  the  failure  rates 
of  the  other  components  of  the  STAR  channel  (as  depicted  in 
Figure  33)  must  be  considered.  When  the  appropriate  values 
from  Table  29  are  added,  the  following  overall  Bypass  state 
probability  is  obtained: 

PBPt  =  AA2  +  AA3  +  AB3  +  AE3  +  AF3  +  AH2  +  AH3 

+  APS  +  AALT  +  ACE  +  AME  +  AHP  +  AHF 
=  886  x  10“6 


Another  failure  state  of  the  IAP  is  the  Null  state,  which 
occurs  under  the  following  condition: 

( A2  +  H3)  G2  (B2  +  C2  +  D2  +  E2  +  F2) 
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TABLE  29.  NON-IAP  STAR  CHANNEL  COMPONENT 
FAILURE  RATES 


Component 

Failure  rate  -  hours 

PS  -  Passive  sensor 

XPS  =  32  x  1CT6 

ALT  -  Alternator 

a alt  =  200  x  10~6 

CE  -  Control  electronics 

XCE  =  220  X  10-6 

ME  -  Monitor  electronics 

XME  =  110  x  10"6 

HP  -  Hydraulic  pump 

XHp  =  160  x  10“6 

HF  -  Hydraulic  fittings 

XRF  =  38  x  10“6 

Manipulating  the  probability  expressions,  the  following 
equation  is  derived: 

PN  ~  (XA2  +  XH3^XB2  +  XC2  +  XD2  +  '’E2  +  XF2^ 

Adding  the  additional  non-IAP  failure  rates,  the  overall  Null 
state  probability  is  obtained: 

PNt  S  (XA2  +  APS  +  ACE  +  AH3  +  AHP^AB2  *  XME  +  XC2 

+  XD2  +  XE2  +  XF2  ^ 

=  6.42  x  10"8 

Another  failure  state  of  the  IAP  is  the  Hardover  state,  which 
occurs  under  the  following  condition: 

A3 (B2  +  D2  +  E2  +  F2)  G2  +  C3(A2  +  A3 )  G2 

Manipulating  the  probability  expressions,  the  following  equa¬ 
tion  is  derived: 

PHO  “  XA3  ^XB2  +  XD2  +  XE2  +  XF2^  +  XC3  ^VA2  +  XA3  ^ 
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Adding  the  additional  non-IAP  failure  rates,  the  overall  Hard- 
over  state  probability  is'  obtained: 

PH0t  S  ^A3  +  APS  +  ACE^AB2  +  AME  +  AD2  +  AE2  +  AF2^ 

+  AC3  ^  AA2  +  APS  +  ACE  ^ 

=  4.53  x  lCf8 


The  last  failure  state  of  the  IAP  is  the  hydraulic  lock  state. 
This  represents  a  potential  condition  when  the  return  check 
valve  and  the  low  pressure  relief  valve  simultaneously  jam  or 
if  the  main  reservoir  piston  or  boot  strap  pistons  jam.  How¬ 
ever,  the  return  and  reservoir  pressures  are  nominally  60  psi. 
Under  the  potential  jam  condition,  this  pressure  would  approach 
2200  psi  (due  to  the  unbalanced  extend/retract  piston  areas 
used  in  this  design).  The  reservoir  end  cap  is  designed  to 
rupture  at  1000  psi  to  prevent  this  possible  hydraulic  lock 
condition.  Hydraulic  lock  would  occur  only  if  this  rupture 

failed  to  occur.  Using  2.5  x  10~6  as  the  failure-to-rupture 
probability,  the  probability  of  an  actual  hydraulic  lock  state 
may  be  written 

PRL  S  2.5  x  10~6  \  =  0.0225  x  10”9 

2 

The  probability  of  the  IAP  being  in  a  particular  state  is 
summarized  in  Table  30. 

4.3.2  STAR  System  Contribution  to  Mission  Abort 

Since  each  channel  has  multiple  states,  the  overall  Swashplate 
Control  state  is  determined  by  a  number  of  possible  combina¬ 
tions  of  the  five  channels.  Five  channel  failure  combinations 
and  event  probability  expressions  are  listed  in  Tables  31 
and  32.  As  presented  in  Table  4,  the  main  rotor  operational 
criteria  are  classified  into  five  cases.  These  cases  are 
tabulated  from  the  design  goal  of  controlling  the  swashplate 
after  two  possible  channel  failures. 

The  following  ground  rules  would  be  applied  for  the  STAR  sys¬ 
tem: 

-  Following  a  first  failure,  maintain  vehicle  velocity  less 
than  or  equal  to  0.6  V^.  (This  allows  full  maneuver 

loads  for  ASH  mission  capability.) 


TABLE  30.  IAP  STATE  PROBABILITY 


State 

Probability 

Normal 

^NORMAL 

=  0.999114 

Bypass 

pbpt 

=  0.000886 

Null 

pnt 

=  0.642  X  10“7 

Hardover 

phot 

=  0.453  X  10"7 

Hydraulic  lock 

PHL 

=  0.0225  x  10" 

-  Following  a  second  channel  failure,  abort  this  mission. 
(However,  maneuver  loads  at  0.6  and  cruise  loads  at 

Vjj  are  still  controllable  after  two  channels  have  been 

switched  to  bypass . ) 

Pilot  decision  to  abort  results  from  system  status  information 
provided  from  the  computer/multiplex,  bus/display  links  from 
the  IAP  electronics.  Normally,  the  monitor  electronics  would 
detect  a  channel  failure,  automatically  switch  the  channel  to 
bypass,  and  provide  pilot  warning. 

Pilot  warning  is  implemented  through  dualized  computer/MRTU/ 
multiplex  bus  channels  to  the  display  unit.  Failure  of  this 
system  can  provide  either  failure  indication  when  there  is  no 
failure  or  no  failure  indication  when  there  is  a  failure.  The 
first  would  contribute  to  the  mission  abort  rate  and  the  latter 
would  contribute  to  decreased  flight  safety.  Instead  of 
aborting  after  a  second-channel  failure  (due  to  no  warning), 
the  pilot  would  continue  to  fly,  thus  increasing  his  proba¬ 
bility  of  crash.  It  will  be  shown,  however,  that  the  pilot 
warning  system  is  quite  reliable  and  the  probability  of 
simultaneous  failure  of  three  control  channels  and  the  pilot 
warning  system  is  quite  low. 
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TABLE  31.  FIVE-CHANNEL  FAILURE  COMBINATIONS 


Case 

No. 


Channel 


2  3  4 


No.  of  Failures 


0  1  2  3  4  5 


Combination 

Probabilit 


0 

0 

0 

0 

0 

0 

0 

0 

0 

1 

0 

0 

0 

1 

0 

0 

0 

0 

1 

1 

0 

0 

1 

0 

0 

0 

0 

1 

0 

1 

0 

0 

1 

1 

0 

0 

0 

1 

1 

1 

0 

1 

0 

0 

0 

0 

1 

0 

0 

1 

0 

1 

0 

1 

0 

0 

1 

0 

1 

1 

0 

1 

1 

0 

0 

0 

1 

_  1 

0 

1 

0 

n 

1 

1 

1 

1 

1 

1 

0 

1 

Total 


X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

III 

IB 

10 

10 

5 

Q2(l-Q)3 
Q(l-Q) 4 
Q2(l-Q)3 
Q2(l-Q)3 
Q3(l-Q)2 
Q  (1-Q)  4 
Q2(l-Q)3 
Q2(l-Q)3 
Q3(l-Q)2 
Q2(l-Q)3 
Q3(l-Q)2 

q3u-q)2 

Q4(l-Q) 

Q  (1-Q)  4 
Q2(l-Q)3 
Q2(l-Q)3 
Q3(l-Q)2 

q2(i-q) 3 

Q3(l-Q)2 

Q3(l-Q)2 

q4(i-q) 
q2(i-q) 3 

Q3d-Q)2 

Q3(1-Q)2 

Q4 (1-Q) 

Q3 (1-Q) 2 

Q4(l-Q) 

Q4(l-Q) 

Q5 
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TABLE  32.  FIVE-CHANNEL  EVENT  PROBABILITIES 


Event 

Event  probability 

T-..  =  (3  or  more  channels 

3M  failed) 

10Q3(1-Q)2  +  5Q4(1-Q)  +  Q5 
=  6Q5  -  15Q4  +  10Q3  *  10Q3 

T«  =  (2  or  more  channels 

2M  failed) 

ioq2(i-q)3  +  t3m 

=  -4Q5  +  15Q4  -  20Q3  +  10Q2  3  10Q2 

Tlv  =  (1  or  more  channels 

1M  failed) 

5Q (1-Q) 4  +  T2m 

=  Q5  -  5Q4  +  10Q3  -  10Q2  +  5Q  3  5Q 

The  failure  rate  of  a  single  computer,  MRTUs ,  and  multiplex 

c 

bus  is  660  per  10  hours.  The  reliability  of  this  single 
pilot  warning  channel  is 


-A 


e 


SC 


where 


Asc  =  660  x  10  u 

Thus,  the  dual  system  pilot  warning  system  failure  rate  can 
be  expressed 


Qpws  =  U-e  AsC)2  S  \sc2  =  0.44  x  10"6 

The  mission  abort  failure  rate  resulting  from  main  rotor  con¬ 
trol  system  failure  is  established  from  the  following  condi¬ 
tions: 

-  Two  channels  become  bypassed  and  the  pilot  is  properly 
warned . 

-  The  pilot  warning  system  provides  false  indication  of 
bypass  condition. 


135 


Indicating  the  first  condition  probability  as  P-^  and  the 
second  as  P2,  the  probability  of  mission  abort  may  be  ex¬ 
pressed  as 

PMA  =  P1  +  P2 

From  Table  30,  the  probability  of  two  channels  in  bypass 
can  be  computed  to  be 

10  Q2(l-Q)3 

where 


Q  =  PDT,  =  0.000886 

***  iji 


Thus, 


pi  “  t10  pbpt2 

=  10  PBP  2  =  7.85  X  10“6 


and 

P2  =  2PWS  =  0-44  X  10-6 

Combining  the  above  probabilities,  the  mission  abort  proba¬ 
bility  becomes 

PMA  =  P1  +  P2  =  8,29  x  10  ~  KMA 

Thus,  the  mean-time-between- aborts  (MTBA)  time  interval  re¬ 
sulting  from  the  STAR  system  failure  can  be  expressed 


MTBA  =  =  121,000  hours 


4.3.3  STAR  System  Contribution  to  Flight  Safety 

Loss  of  control  of  the  main  rotor  swashplate  can  result  in 
loss  of  flight  safety,  i.e.,  a  possible  catastrophic  condi¬ 
tion.  This  situation  would  result  from  any  of  the  following 
conditions: 

-  Three  or  more  IAPs  in  Bypass  state 

-  Two  or  more  IAPs  in  Hardover  or  Null  state 
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-  One  or  more  IAPs  in  Hardover  or  Null  state  simultaneous 
with  a  load  relief  failure  (F2)  in  the  failed  channel 

-  One  or  more  IAPs  hydraulically  locked 

Indicating  the  probability  of  these  conditions  as  P-^,  P2, 

P3,  and  P^,  respectively,  the  catastrophic  failure  probabil¬ 
ity  may  be  expressed  as 


pc  = 


P1  +  P2  +  P3  +  P4 


Using  Tables  30  and  32,  the  following  probabilities  are  ob¬ 
tained 

P1  =  10  Pfip  3  =  10( . 886  x  10"3)3  =  7.0  x  10~9 

P2  *  10<PHOt  +  Pn/  =  °'12  *  10'12 
P3  =  5<PHOt  +  PNt)XF2  =  6'8  x  10-12 

P4  "  5  PHL  =1-125  x  10"10 


Thus,  the  catastrophic  failure  probability  becomes 
Pc  =  (7.0  +  0.00012  +  0.0068  +  0.11)  x  10'9 
=  7.1  x  10"9  2  kQ 

and  the  mean-time-between-crashes  ( MTBC )  time  interval 
resulting  from  the  STAR  system  failure  can  be  expressed 

MTBC  =  r—  =  1.41  x  108  hours 


4.3.4  Power  Supply  Configuration 

The  hydraulic  power  supply  consists  of  five  mechanically 
driven,  dedicated  hydraulic  pumps  individually  plumbed  to  a 
specific  IAP  and  an  electrically  driven  utility  hydraulic 
system.  The  utility  system  is  used  for  ground  checkout  of  the 
FBW  system  and  certain  other  auxiliary  functions.  This  is 
discussed  in  Section  2. 2. 5. 3. 
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Only  the  main  rotor  requires  hydraulic  pressure.  The  redun¬ 
dancy  management  consists  of  simply  including  a  pump  in  each 
of  the  five  parallel  control  channels.  If  a  pump  fails,  that 
particular  channel  is  switched  into  bypass.  (It  is  noted  that 
the  possibility  exists  for  redesigning  the  redundancy  manage¬ 
ment  logic  so  as  to  switch  the  failed  pump  and  use  the 
utility  supply.) 

The  electrical  power  supplies  are  configured  as  presented  in 
Paragraph  2. 2. 6.1.  As  is  the  case  with  the  hydraulic  pumps, 
the  dedicated  STAR  alternators  are  made  an  integral  part  of 
each  parallel  channel.  If  the  alternator  fails,  that  parti¬ 
cular  channel  is  switched  into  bypass.  (It  is  again  noted 
that  the  possibility  exists  for  utilizing  the  battery  for 
backup.)  Since  the  loss  of  electrical  power  disables  the  IAP 
electronic  monitors  (the  IAP  automatically  switches  to  bypass 
with  loss  of  voltage  to  the  engage  solenoid),  the  computers 
(which  perform  command  augmentation,  pilot  warning  functions, 
etc.)  detect  the  anomaly  of  the  data  code  from  the  IAP  and 
provide  appropriate  warning  to  the  pilot. 

4.3.5  Hardover  and  Jam  Considerations 

As  derived  in  Paragraph  4.3.1,  the  probability  of  a  hardover 
condition  in  a  STAR  channel  is  extremely  low: 

Prob [Hardover]  =  4.53  x  10~8 

Since  there  are  five  channels,  the  system  probability  is  five 
times  as  large.  However,  a  design  provision  for  such  an 
extremely  rare  event  allows  the  other  four  actuators  to  over¬ 
ride  the  hardover  channel  through  a  pressure  load-relief 
valve.  (An  example  of  the  type  of  load  reaction  capability 
that  the  IAPs  exhibit  in  such  a  condition  is  presented  in 
Table  8. ) 

As  in  the  case  of  the  dual  mechanical  system,  a  jammed  actuator 
could  be  catastrophic.  The  IAP  is  designed  in  an  attempt  to 
provide  a  jam-proof  actuator  (see  Paragraph  2.2. 5.2).  One 
advantage  of  the  STAR  configuration  over  the  dual  mechanical 
system  is  the  force  advantage  that  the  configuration  offers  to 
break  a  possible  jam.  In  fact,  a  force  of  2.2  times  the 
design  load  of  the  IAP  will  be  available  from  the  resultant  of 
the  other  four  normal  IAPs  to  break  any  potential  jam. 
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5.  ADVANCED  COCKPIT  CONTROLS  AND  DISPLAYS 


The  use  of  fly-by-wire  controls  for  a  helicopter  allows  im¬ 
provements  in  cockpit  design  by  the  use  of  new  controls  and 
displays.  With  these  improved  controls  and  displays,,  the 
pilot  can  improve  performance  with  greater  comfort  and  reduced 
workload. 

In  addition,  the  use  of  redundant  electronic  channels  in  a 
fly-by-wire  system  makes  cockpit  situation  displays  and  fail¬ 
ure  management  control  desirable.  These  control  and  display 
concerns  are  discussed  below. 

5.1  Cockpit  Control  Considerations 

A  limited  effort  was  directed  at  two  aspects  of  cockpit  con¬ 
trols  that  are  of  prime  importance  in  the  consideration  of 
fly-by-wire  implementations.  One  aspect  is  the  option  of 
center-mounted  versus  side-arm-mounted  controls.  Another 
aspect  is  the  option  of  force  control  versus  displacement 
control . 

Table  33  is  a  summary  of  trade-offs  using  center-mounted 
versus  side-arm  cyclic  control.  This  summary  indicates  that 
many  advantages  are  afforded  by  the  side-arm  implementation. 

Table  34  is  a  summary  of  trade-offs  using  a  force  control 
versus  displacement  control  for  cyclic.  This  summary  indi¬ 
cates  that  a  force  cyclic  control  with  displacement  may  offer 
the  most  advantages.  The  displacement  could  be  small  (on  the 
order  of  25  to  30  degrees  total  travel)  using  a  5-  to  6-inch- 
high  stick.  Figures  35  and  36  indicate  desired  relationships 
for  control.  The  displacement  would  be  for  control  position 
feedback  only  and  not  be  part  of  the  actual  control  loop.  The 
necessity  for  a  copilot  control  to  have  the  displacement 
feature  has  not  been  established?  however,  it  seems  feasible 
in  a  system  such  as  an  ASH  that  the  copilot,  since  he  is  not 
the  primary  pilot,  could  operate  from  force  response  only 
without  the  displacement  feedback.  This  type  of  control  could 
be  integrated  with  his  system  controllers  to  save  space  and  to 
be  immediately  available  for  use.  The  final  configuration  and 
mechanization  of  the  force  rate  cyclic  would  have  to  be  deter¬ 
mined  through  simulator  or  flight  test.  In  the  development  of 
the  fly-by-wire  control  system  for  the  USAF  Model  F-16,  one  of 
the  enhancing  characteristics  of  the  system  was  the  ability  to 
quickly  and  easily  change  the  response  characteristics  of  the 
force  stick. 
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TABLE  34.  SUMMARY  OF  TRADE-OFFS  ON  USING  FORCE  VS.  POSITION  CYCLIC  CONTROL 
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EXTRACTED  FROM  FIXED  WING  DATA. 

BASED  ON  RATINGS  OF  PILOTS  USING  COOPER-HARPER  SCALE. 
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Figure  35.  Force  characteristics  desired  for  cockpit  controls 


LATERAL  STICK  FORCE ,  LB 

Figure  36.  Cockpit  controls  desired 

displacement  characteristics. 
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5.1.1  Consideration  of  Integrated  Controls 

In  the  consideration  of  fly-by-wire  cockpit  controls,  consid¬ 
eration  was  given  to  integrated  controls,  i.e.,  cyclic  and 
collective  operation  with  one  hand. 

Many  of  these  types  of  controls  have  been  built  and  tested  to 
various  degrees  of  substantiation,  but  a  review  of  these 
designs  points  out  that  they  have  either  been  used  for  limited, 
special-purpose  control,  or  they  create  potentially  severe 
physical  coupling  problems. 

One  integrated  control  concept  under  consideration  in  BHT 
research  is  shown  in  Figure  37.  Pitch  and  roll  are  controlled 
by  conventional  displacements;  collective  is  controlled  by 
rotating  the  "T"-handle.  Increased  collective  pitch  is  pro¬ 
vided  by  clockwise  rotation. 

With  full  authority  control  for  a  highly  maneuverable  air  ve¬ 
hicle,  such  as  ASH,  the  operator  coupling  problem  should  be 
thoroughly  studied  in  simulator  or  flight  test  vehicles.  If 
an  integrated  control  becomes  accepted  and  proven,  it  could 
easily  be  adapted  to  the  FBW  implementation  without  major 
redesign,  thus,  again  pointing  up  another  advantage  of  FBW/ 
Light  control. 

5.1.2  Consideration  of  Side-Arm  Controls 

Consideration  was  given  to  a  side-arm  controller  with  conven¬ 
tional  left-hand-operated,  displacement- type  collective  input. 
The  controller  was  configured  to  implement  the  desired  control 
response,  as  shown  in  Figures  35  and  36. 

The  side-arm  controller  is  a  gimballed  short  stick  approxi¬ 
mately  six  inches  long  with  a  standard  grip  arrangement.  The 
control  signals  are  a  function  of  force  on  the  stick,  with  the 
force  output  gradient  varied  with  velocity  to  conform  to  the 
Army  handling  qualities  specification.  The  position  of  the 
stick  will  continuously  trim  as  a  function  of  swashplate 
angle. 

The  controller  utilizes  an  assembly  with  five  force  trans¬ 
ducers.  The  five  transducers  will  be  positioned  around  the 
stick  at  azimuth  angles  corresponding  to  the  five  swashplate 
actuators  that  will  be  controlled  by  the  transducer  outputs. 
Each  of  the  five  transducers  will  provide  signals  to  one  of 
the  five  channels  of  STAR.  The  system  will  be  configured  to 
modify  the  sensor  outputs  to  give  a  force  gradient  proportional 
to  velocity.  At  the  low  end,  the  signal  per  force  increment 
will  be  large.  At  the  high  velocity  end,  the  signal  per  force 
increment  will  be  small  causing  the  pilot  to  be  aware  of 
approaching  control  limits  by  increased  stick  reaction. 
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An  automatic  trim  will  be  accomplished  by  two  rate-limited 
trim  actuators  in  the  pitch-and-roll  axis.  The  trim  displace¬ 
ment  of  the  stick  will  be  stick  displacement  proportional  to 
swashplate  angle.  The  result  will  be  that  the  pilot  will  be 
alerted  to  the  present  flight  situation  and  control  limits  by 
both  displacement  and  force  feedback  from  the  sticks. 

Pilot  and  copilot  sticks  each  have  a  complete  set  of  sensors 
and  trim  actuators.  There  is  no  mechanical  link  between 
sticks.  Force  and  displacement  registration  of  the  sticks  are 
accomplished  electronically. 

5.1.3  Selection  of  Control  Stick  Configuration  for  Study 

The  final  selection  of  the  control  stick  configuration  for  the 
baseline  FBW  system  for  ASH  was  influenced  by  the  requirement 
that  the  technology  level  used  be  applicable  for  a  1980  con¬ 
tract  go-ahead.  The  technology  necessary  for  side-arm  dis¬ 
placement  sticks  would  permit  its  use  in  this  time  frame. 

There  are,  however,  certain  questions  about  the  exact  imple¬ 
mentation  of  such  sticks  that  should  be  answered  by  simulator 
and/or  flight  tests.  Since  it  is  not  known  whether  time  for 
such  evaluations  would  exist,  it  was  determined  that  conven¬ 
tional  sticks' would  be  used  for  the  comparison  study.  Trade¬ 
off  considerations  show  that  the  side-arm  force  sticks  are 
really  the  most  promising  concept  and,  given  time  for  refine¬ 
ment,  would  be  the  preferred  stick  design. 

Figure  13  shows  the  stick  design.  Conventional  cyclic  sticks 
are  used  with  five  passive  optical  sensors  attached.  Each  of 
the  five  sensors  are  mounted  at  the  same  azimuth  angle  as  the 
corresponding  integrated  actuator  package  to  which  it  serves 
as  a  signal  source.  The  two  cyclic  sticks  are  mechanically 
coupled  to  move  together.  The  collective  sticks  that  are  also 
mechanically  interconnected  have  an  input  to  a  mechanical 
mixer  that  mixes  the  collective  signal  with  cyclic  for  each 
sensor  so  that  the  output  of  each  passive  optical  sensor  is 
the  summed  cylic  and  collective  for  that  channel. 

The  antitorque  pedal  controls  are  conventional.  The  intercon¬ 
nected  pilot  and  copilot  controls  are  attached  to  three  passive 
optical  sensors.  The  output  of  each  of  the  three  sensors  goes 
to  one  of  the  anti torque  fly-by-wire  channels. 

5.2  DISPLAYS 

The  crewstation  display  associated  with  the  FBW/L  system  is  a 
result  of  information  requirements  for  the  preflight  and  safe 
in-flight  operations  of  the  system.  Although  the  system  will 
have  extensive  self-test  and  diagnostic  capability,  along  with 
its  unique  fail-safe,  multiple-channel  operation,  certain 
cockpit  information  will  be  required.  The  requirements  are 
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based  on  a  Hazard  Modes  and  Effects  Analysis  (HMEA)  and  the 
need  for  certain  information  to  insure  proper  preflight  check¬ 
out.  An  indication  of  IAP  status  is  necessary  in  order  to 
ascertain  whether  an  abort  situation  is  occurring.  Without 
such  indication,  flight  safety  is  significantly  reduced. 

Actual  control  display  for  the  FBW/L  control  system  is  con¬ 
sidered  to  be  integrated  with  the  multifunction  display  system 
and  coordinates  under  dual  multiplex  bus/computer  supervision, 
as  discussed  in  Paragraphs  2. 2. 6. 4  and  2. 2. 6. 5.  This  approach 
will  provide  much  more  flexibility  for  test  checkout  and 
diagnostics.  The  multifunction,  or  CRT- type,  display  will  be 
programmed  to  allow  checkout  and  status  as  a  function  of 
keyboard  access  data.  Procedures  for  checkout,  as  well  as 
actual  test  data,  will  be  easily  displayed  to  the  flight  crew 
or  maintenance  crew  for  preflight,  in-flight,  or  postflight 
use.  A  typical  example  of  how  a  system  of  this  type  could  be 
used  for  a  preflight  checkout  is  as  follows: 

-  Crew  power-up  displays  and  bus  system 

-  Access  data  key  for  "control  system  check" 

-  This  results  in  paging  of  data  showing  all  channels  in 
"bypass"  and  why.  (This  is  due  to  no  hydraulic  power  to 
enable  second-stage  EHSV  spool,  thus,  tripping  monitor.) 
If  all  channels  do  not  indicate  bypass,  the  monitor 
system  has  a  fault. 

-  Selects  "AUX  PUMP  PWR"  and  "SEQUENCE  IAP"  on  the  display 
page.  This  powers  the  auxiliary  hydraulic  pump  and 
develops  hydraulic  pressure.  The  sequence  then  commands 
each  IAP  into  an  auxiliary  pump  mode. 

-  The  IAP  in  auxiliary  pump  mode  will  remove  the  bypass 
condition  if  the  "Sequence  IAP"  is  successful. 

-  The  system  is  now  operable  for  starting,  and  the  other 
aircraft  preflight  procedures  can  be  continued. 

After  the  rotor  is  turning,  the  system  initiates  a  powered-up 
check  and  will  indicate  any  bypass  condition  for  the  primary 
hydraulic  actuators. 
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6  *  WEIGHT  IMPACT  EVALUATION 


The  performance  of  a  helicopter  is  determined  to  a  large 
degree  by  its  gross  weight.  Gross  weight  is  determined  by  its 
constituent  weights  -  empty  weight,  fixed  useful  load,  payload, 
and  fuel.  Various  combinations  of  these  constituent  weights 
c.vn  obviously  result  in  the  same  gross  weight.  Performance 
for  th~:  -subject  9544  gross  weight  vehicle  is  depicted  in 
Figures  38  through  41.  From  Figure  42,  it  is  seen  that  the 
mission  range  for  £?  sea  level,  standard  day  condition  is  ap¬ 
proximately  100  nautical  miles. 

It  was  shown  in  Paragraph  3.2  that  the  FBW/L  flight  control 
system  was  143  pounds  lighter  than  the  dual  mechanical  flight 
control  system.  Advantage  of  this  weight  savings  may  be  taken 
by  increasing  fuel  capacity  or  by  increasing  the  payload. 

Empty  weight  of  the  ASH  mission  dual  mechanical  MUT  was  in¬ 
creased  by  83  pounds  over  the  original  MUT.  To  maintain  the 
original  gross  weight  and  fuel  capacity,  the  payload  was 
reduced  from  960  pounds  to  877  pounds.  The  trade-off  of  the 
143  pounds  weight  savings  of  the  FBW/L  system  mechanization 
can  be  visualized  from  Figure  42.  If  the  same  fuel  capacity 
is  maintained,  then  143  pounds  additional  payload  may  be 
carried  for  the  100-nautical-mile  mission.  If  the  payload  is 
maintained,  then  the  added  fuel  allows  a  15-percent  increase 
in  mission  range. 
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Figure  38.  MUT  maximum  speed  vs  GW. 
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Figure  39.  MUT  service  ceiling  vs  GW. 
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Figure  40.  MUT  hover  ceiling  vs  GW. 
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Figure  42.  MUT  payload  versus  radius. 
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7.  CONCLUSIONS 


Conclusions  drawn  from  this  study  comparing  a  FBW/L  control 
system  with  a  dual  mechanical  control  are: 

-  Significant  payoffs  are  predicted  when  applying  fly¬ 
by-wire/light  technology  to  helicopter  flight  control 
systems . 

-  The  flight  safety  goal  (no  more  than  one  catastrophic 
failure  per  107  hours  of  operation)  can  be  achieved  by 
both  the  dual  mechanical  system  and  the  FBW/L  control 
system.  The  dual  mechanical  system  is  predicted  to  be 
approximately  three  orders  of  magnitude  better  than  the 
FBW/L  control  system.  (Although  not  detailed  here,  it 
can  be  shown  that  the  FBW/L  control  system  is  predicted 
to  be  approximately  two  orders  of  magnitude  better  than  a 
single  mechanical  control  system.) 

-  The  mission  failure  goal  (no  more  than  one  failure  per 
104  hours  of  flight)  can  be  achieved  by  the  FBW/L 
control  system  (provided  the  cockpit  control  linkage 
to  the  control  transducers  is  so  designed  that  its 
failure  rate  contribution  to  mission  failure  is  negli¬ 
gible).  This  goal  cannot  be  met  by  the  dual  mechanical 
control  system. 

-  The  system  MTBF  goal  of  2500  hours  cannot  be  met  by 
either  the  dual  mechanical  or  the  FBW/L  control  sys¬ 
tem.  However,  the  FBW/L  system  is  approximately  28 
percent  better  than  the  dual  mechanical  system. 

-  Both  dual  mechanical  and  FBW/L  control  systems  have  low 
vulnerable  areas  to  the  12.7mm  API  threat  with  the 
FBW/L  system  exhibiting  0.26  square  feet  less  area. 

Both  systems  have  good  survivability  to  the  23mm  HEI-T 
but  the  FBW/L  control  system  is  slightly  worse  due  to 
the  vulnerability  of  the  control  motion  transducers 

to  blast  and  fragmentation  damage.  (This  could  be 
eliminated  by  adding  5  to  10  pounds  of  armor  plate  or 
by  the  use  of  side-arm  force  controllers.) 

-  Maintainability  characteristics  of  the  FBW/L  control 
system  are  superior  to  those  of  the  dual  mechanical 
system.  Organizational  corrective  maintenance  for  the 
FBW/L  system  is  approximately  one-third  that  of  the  dual 
mechanical  system.  Daily  preventive  maintenance  is  ap¬ 
proximately  one-half.  The  FBW/L  system  is,  thus,  more 
available. 
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The  weight  of  the  FBW/L  control  system  (with  conventional 
cockpit  controls)  is  143  pounds  lighter  than  the  dual 
mechanical  system.  This  weight  differential  may  contri¬ 
bute  to  either  increased  mission  range  (fuel)  or  increased 
payload. 

FBW/L  control  system  life-cycle  cost  savings  in  constant 
1979  dollars  amounts  to  approximately  $0.2  Billion.  The 
larger  nonrecurring  tooling  and  production  engineering 
cost  for  the  dual  mechanical  system  offsets  the  extra 
cost  of  nonrecurring  vendor  development  and  qualifica¬ 
tion  tests  and  flight  testing  of  the  FBW/L  system.  The 
other  significant  cost  savings  result  from  the  reduced 
maintenance  cost  associated  with  the  modularized  FBW/L 
system  with  built-in  test  capability. 

Maximum  benefit  from  FBW/L  technology  is  not  obtained 
unless  advanced  cockpit  control  and  display  concepts  are 
utilized. 

The  5-arm  rise/fall  swashplate  main  rotor  swashplate 
control  system  (STAR)  is  applicable  to  any  helicopter. 

FBW/L  systems  for  helicopters  are  considered  within  the 
state-of-the-art  for  a  development  program.  Much  of 
the  system  presented  here  has  undergone  laboratory  and 
Iron  Bird  testing. 
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